News and views from a software developer's perspective
Friday, April 19, 2002Yesterday I discovered Yarrow, a free tool from Counterpane Internet Security (Bruce Schneier, et. al.) for generating cryptographically secure random bits. The problem I have with Yarrow, is that it depends on mouse movements and key presses. Yes, those may be good sources of randomness, but I think there must be a less intrusive way to collect randomness. How about collecting random bits without requiring anything from the user? Completely behind the scenes?
There is Intel's hardware random number generator, which works only on motherboards that use the Intel chipsets. That's a very good solution if you have a motherboard based on the Intel chipset and you don't mind installing the driver software.
On Linux and BSD variants, there is /dev/random or something similar. This is a very good solution.
But, what about Solaris? I am thinking about developing my own solution. It will gather kernel statistics using the kstat routines, and it will gather process statistics using by reading from files in /proc. All this information will be mixed together using the SHA-1 hash algorithm. Finally, and this is the real deal: it will use gethrtime to collect lots of timings at a very high precision. On my sparc machine, the precision is 180 ns. It seems that there is a lot of unpredictability in how much time is spent executing system calls. A program could therefore gather a lot of unpredictability by timing the system calls. Not only that, but you could estimate the amount of entropy by repeating the exact same system call multiple times and collecting statistics on the timings. It makes perfect sense to me, because if an attacker wanted to attack your random number source, he would run the same sequence of system calls, generate the timings, and use those timings to reduce the search space. If you collect stats on the timings, you can estimate the extent to which the attacker could limit the search space. For example, if a particular system call takes either 3 or 4 us with equal probability, that is one bit of randomness. An attacker could limit his search space to 3 or 4 for that particular source. But if you have 256 such sources, then the attacker has a very large search space! (In fact, my measurements indicate much more randomness than this simple example implies.) If I implement this, what it will provide is a source of random bits and a (conservative) estimate of the amount of entropy, with minimal intrusiveness (no mouse movements required). The only downside is that it will be very system-specific.
DevX C++ Zone: ... about 3 million of the approximately 9.5 million software developers worldwide use C++. Java still comes in a distant second or third at about 50 percent to 70 percent of the C++ developer numbers, depending on which study you look at.
You mean I'm one in 3 million!
Slashdot: Researchers have discovered that across the entire web, links are distributed according to a "power law" which leads to "rich get richer" or "winner's take all" behaviour where a small number of sites get the vast majority of links and traffic.
This is interesting! A few years ago, we heard that Amazon.com and many other e-tailers would not be able to achieve good profit margins on the web, because the competition is just a simple mouse-click away. Then we heard about "mind-share". Now, we hear that because of a "power law", or "winners take all", or "rich get richer", that Amazon.com has a huge market share, and that it will be difficult for any competitor to dislodge them. Sounds like a 180-degree turn from the original thinking of the web.
Deep Linking Returns to Surface. The Danish Newspaper Publishers' Association is trying to stop a news service from linking to stories within its website in a case some fear may alter the natural course of the Web. By Michelle Delio. [Wired News]
I sure hope the courts take into consideration the "tradition" of the World Wide Web. First, it was the World Wide Web. Then, it became the World Wide Web Controlled By Commercial Interests. In that order. In my opinion, if the commercial interests want to use the web, they should adapt to the web, and not try to force the web to adapt to them.
