Entropy Estimation on the Basis of a Entropy Estimation on the Basis Stochastic Model of a Stochastic Model Werner Schindler Bundesamt f¨ ur Sicherheit in der Werner Schindler Informations- technik Bundesamt f¨ ur Sicherheit in der Informationstechnik (BSI) (BSI) Bonn, Germany Motivation and Background Presented by Peter Birkner The Stochastic Model Experiences with the AIS Gaithersburg, May 2, 2016 31 Conclusion
Introduction Entropy Estimation on the Basis of a Stochastic Model Werner Motivation and Background Schindler Bundesamt Stochastic model f¨ ur Sicherheit in der Definition and objective Informations- technik Illustrating examples (BSI) Health tests (online tests) Motivation Experiences with the AIS 31 and Background Conclusion The Stochastic Model Experiences with the AIS 31 Conclusion
NIST SP 800-90B [4] Entropy Estimation on the Basis of a Stochastic Model Werner Schindler Entropy estimation is the most critical part of a security Bundesamt f¨ ur Sicherheit evaluation of a physical RNG. in der Informations- Among others [4], Subsection 3.2.2, demands that the technik (BSI) documentation ... shall include a description of how the noise source works and rationale about why the noise Motivation and source provides acceptable entropy output,... Background The Stochastic Model Experiences with the AIS 31 Conclusion
Entropy estimation Entropy Estimation on the Basis of a Stochastic Model Unfortunately, entropy cannot be measured like voltage Werner Schindler and temperature. Bundesamt f¨ ur Sicherheit Instead, entropy is a property of random variables. in der Informations- In the following we interpret random numbers as technik (BSI) realizations of (i.e. as values taken on by) random Motivation variables. and Background We present a field-tested method for the estimation of the The entropy of physical RNGs. Stochastic Model Experiences with the AIS 31 Conclusion
Notation Entropy Estimation on the Basis of a Stochastic In the following we use the terminology of SP 800-90B [4]. Model In particular, Werner Schindler digitized data = data after the digitization of the analog Bundesamt f¨ ur Sicherheit signals in der raw data = data after (non-cryptographic) postprocessing Informations- technik (BSI) NOTE: In the literature also other definitions are widespread. In particular, Motivation and raw random numbers (or digitized analog signals) = data Background after digitization The internal random numbers = data after (non-cryptographic Stochastic Model / cryptographic) postprocessing Experiences with the AIS 31 Conclusion
What is a stochastic model? Entropy Estimation on the Basis of a Stochastic Ideally, a stochastic model specifies a family of probability Model distributions, which contains the true (but unknown) Werner Schindler distribution of the raw data (interpreted as realizations of Bundesamt f¨ ur Sicherheit random variables). in der Informations- In a second step therefrom the (average gain of) entropy technik (BSI) per raw data bit is estimated. Motivation In most cases it is yet easier to develop and to verify a and Background stochastic model for the digitized data (or, alternatively, The for suitable ’auxiliary random variables’). Stochastic Model → entropy(digitized data) → entropy(raw data) Experiences with the AIS 31 Conclusion
Example 1: Coin tossing Entropy Estimation on the Basis of a Stochastic Model A coin is tossed N times (’head’ c 1, ’tail’ c 0’). Werner Schindler We interpret the observed outcome x 1 , . . . , x N (= digitized Bundesamt f¨ ur Sicherheit data) of N coin tosses as realizations of random variables in der Informations- X 1 , . . . , X N . technik (BSI) The random variables X 1 , . . . , X N are assumed to be iid (independent and identically distributed). Motivation and Justification: A coin has no memory. Background The p := Prob ( X j = 1) ∈ [0 , 1] with unknown parameter p . Stochastic Model Experiences with the AIS 31 Conclusion
Example 1: Entropy estimation Entropy Estimation on X 1 , . . . , X N are iid = ⇒ H ( X 1 , . . . , X N ) / N = H ( X 1 ) the Basis of a (= (average) entropy per coin toss) where Stochastic Model Werner H ( X 1 ) = − ( p log 2 ( p )+(1 − p ) log 2 (1 − p )) (Shannon entropy) Schindler Bundesamt f¨ ur Sicherheit in der Equivalently, H min ( X 1 , . . . , X N ) / N = H min ( X 1 ) with Informations- technik (BSI) H min ( X 1 ) = min {− log 2 ( p ) , − log 2 (1 − p ) } (min entropy) Motivation and Background x 1 + · · · + x N p := p (estimator for p ) The N Stochastic Model Substituting p p into the above formulae provides estimators Experiences with the AIS for the Shannon entropy and for the min entropy per coin 31 toss. Conclusion
Example 1: Stochastic model Entropy Estimation on the Basis of a Stochastic Model A stochastic model is not a physical model. In Example 1 Werner Schindler a physical model would consider the impact of the start Bundesamt f¨ ur Sicherheit conditions and the mass distribution within the coin etc. in der Informations- on the trajectory. technik (BSI) It is much easier to develop and to verify a stochastic model than a physical model. Motivation and Background In our coin tossing example the stochastic model defines a The 1-parameter family of probability distributions. Stochastic Model Experiences with the AIS 31 Conclusion
Real world RNGs Entropy Estimation on the Basis For real world physical RNGs the derivation of the of a Stochastic stochastic model is more complicated. The stochastic Model model should be confirmed by engineering arguments and Werner Schindler experiments. Bundesamt f¨ ur Sicherheit in der Typically, a stochastic model specifies a 1-, 2- or a Informations- technik 3-parameter family of distributions. (BSI) If the digitized data are not iid the increase of entropy per Motivation random bit has to be considered. and Background During the life cycle of the RNG the true distribution shall The Stochastic remain in the specified family of probability distributions, Model also if the quality of the random numbers goes down Experiences with the AIS ( → health tests). 31 Conclusion
Example 2: Killmann, Schindler (CHES 2008)[6] Entropy Estimation on the Basis of a Stochastic Model Werner Schindler Bundesamt f¨ ur Sicherheit in der Abbildung: RNG with two noisy diodes, c.f. Fig. 1 in [6] Informations- technik (BSI) Stochastic model (for y 1 , y 2 , . . . ) Motivation and t n : time between the ( n − 1) th and the n th upcrossing Background The T 1 , T 2 , . . . is stationary (mild assumption) - . . . . . . - Stochastic Model Y 1 , Y 2 , . . . is stationary Experiences 2-parameter family of distributions (depends on the with the AIS 31 expectation and the generalized variance of T 1 ) Conclusion details: see [6]
Example 3: Haddad, Fischer, Bernard, Nicolai [5] Entropy Estimation on the Basis of a Stochastic Model Source of randomness: transient effect ring oscillator Werner Schindler (TERO) Bundesamt f¨ ur Sicherheit Thorough analysis of the electric processes in the TERO in der Informations- structure technik (BSI) → stochastic model of the TERO Motivation → stochastic model of the complete RNG and Background Implementation of the RNG design on a 28 nm CMOS The ASIC Stochastic Model Experiences with the AIS 31 Conclusion
Health tests (online tests) Entropy Estimation on the Basis of a Stochastic Model Health tests, which are universally effective for any RNG Werner design, do not exist. Schindler Bundesamt The health test (online test) should be tailored to the f¨ ur Sicherheit in der stochastic model. The health test should detect Informations- technik non-tolerable deficiencies of the random numbers (BSI) sufficiently soon. Motivation and Example 1: A monobit test would be suitable. Background If # ’1’s deviates significantly from sample size / 2 The Stochastic - indicator that p is (no longer) acceptable. Model Experiences with the AIS 31 Conclusion
AIS 20 [1] / AIS 31 [2] Entropy Estimation on the Basis of a Stochastic Model In the German evaluation and certification scheme the Werner evaluation guidance documents Schindler Bundesamt AIS 20: Functionality Classes and Evaluation Methodology f¨ ur Sicherheit in der for Deterministic Random Number Generators Informations- technik AIS 31: Functionality Classes and Evaluation Methodology (BSI) for Physical Random Number Generators Motivation have been effective since 1999, resp. since 2001. and Background NOTE: The mathematical-technical reference [3] was The updated in 2011. Stochastic Model Experiences with the AIS 31 Conclusion
Functionality classes Entropy Estimation on the Basis of a Stochastic Model Werner Schindler Bundesamt f¨ ur Sicherheit in der Informations- technik (BSI) Motivation and Background The Stochastic Model Experiences with the AIS 31 Conclusion
Miscellaneous Entropy Estimation on the Basis The AIS 20 and the AIS 31 are technically neutral. of a Stochastic Model For physical RNGs (PTG.2, PTG.3) a stochastic model is Werner mandatory. The digitized data shall be stationary Schindler Bundesamt distributed. f¨ ur Sicherheit in der The applicant for a certificate and the security lab have to Informations- technik give evidence that the RNG meets the class-specific (BSI) requirements. Motivation and Further documents support the tasks of the developer and Background the evaluator. The Stochastic For sensitive applications the BSI prefers RNGs, which Model belong to the functionality classes PTG.3, DRG.4 or Experiences with the AIS DRG.3. 31 Conclusion
Recommend
More recommend
