Intel’s search for a better “S” in HTTPS, or how to make random numbers
Share This article
They say that the weakest link in computer and networking security is the user. While true on just about every level, it doesn’t mean that technology companies haven’t been working hard to make sure that the hardware is keeping users as secure as possible in the most efficient way. One company, Intel, has recently come up with a way to do that better.
Security at the hardware level isn’t something that you’d normally think about. As a user, your responsibility to keeping a secure environment is making sure you don’t make your password your dog’s name, not what happens to information after you input it. That nebulous space between your keyboard and someone else’s screen is where the magic happens, and security there is someone else’s job. The nuts and bolts of how that sorcery is cast is beyond the scope of this article, but explained in great detail by the good folks at IEEE Spectrum. What I want to talk about is how Intel is doing it’s part, in a way that a non-technical person can easily understand.
Computers live in a world of ones and zeroes, and as such, there’s not a ton of randomness to be had. Randomness is, though, easily the single most important piece of the defensive puzzle of passwords and encryption; the cornerstone of the wall between you and malicious parties trying to part you and your personal information. Encryption is just a code wrapping around your sensitive data. Randomness makes that code indecipherable. As such, hardware manufacturers have taken great pains to incorporate the best possible math and science into their products to keep users safe.
Intel, one of the largest hardware manufacturers out there, solves this problem with an analog hardware based random number generator installed on many of their chipsets. In a digital world, however, this has become problematic as technology outstrips the analog base, and power-saving becomes more and more important to the products we use today, making analog power-hungry hardware obsolete. For the layman, analog hardware would be akin to a clock with hands; a device whose input is determined by continuously variable quantities (position of the hands, in this instance). Digital data is represented as on or off; one or zero. There’s no variable, no randomness.
Intel’s solution is a digital system that allows a microprocessor to make random values without relying on analog circuitry to do it. To understand how that is, we’ll have to delve in a bit into how analog circuitry currently works and how digital technology can do it more efficiently. I’m going to quote some extremely technical documentation and then run through it in layman’s terms.
Intel’s first attempt to help an average computer produce better random numbers came in 1999, when the company introduced the Firmware Hub chipset component. The random-number generator in that chip [PDF] is a ring-oscillator-based analog design that works by taking some of the thermal noise that’s present in all resistors, amplifying it, then using the resulting jittery signal to change the period of a relatively slow-running clock. On each of the erratic ticks of that slow clock, the chip then samples the output of a second, fast-running clock, which cycles back and forth quite regularly between its two possible binary states: 0 and 1. That erratic sampling then produces a random sequence of 1s and 0s.
That’s sorcery at it’s most arcane, but it can be boiled down to extracting randomness from the white noise present in all electronics. Power is noisy, if you know how to listen. Remember, too, that all of this is just to be able to create as random a string of numbers as possible because a computer can’t do it on its own.
That was more than 10 years ago (remember when I said the internet doesn’t like change), and the technology hasn’t changed much since then. In 1998 the encryption was 40 bit strings; today’s AES strings are commonly 128 bits (256 or more is available but largely unnecessary), which allows for 3,400,000,000,000,000,000,000,000,000,000,000,000,000 characters to be used in encryption for items that are deemed worthy of the best security. That would take more time to crack than our currently technology allows unless you lived to be very, very old and are very, very patient.
Heads or tails?
So, what has Intel done to make it work? It’s incredibly complicated, but we’ll try to explain: Intel has built in a pair of inverters that are connected to each other, and also to a transistor. When powered on, both input and output on the inverters is forced to the on state. When powered off, there’s the slightest of delays while the circuit tries to decide where to send output. Thermal noise like random atomic vibrations will tip the balance towards one side or the other, with that random noise determining the final path of the circuit — which is about as random as a digital circuit can get. The transistor is hooked up to a clock that regularly turns them on and off to generate the randomness effect, and there you have a system of producing random numbers in a digital system.
That explanation is oversimplified, but it leads us onto the next question: “But what’s the benefit?” The benefit is in power consumption efficiency (though we have no hard numbers at present), and in chip size and complexity. Not having to build circuitry around archaic analog components is going to make chips smaller, fast. Speaking of fast, Intel’s RdRand instruction (used on its upcoming 64-bit Ivy Bridge microprocessors) has seen a 37% increase in speed over it’s predecessor. That’s fast.
If technological advancements continue to make things smaller and faster at the pace they are today, it’s not unreasonable to look at the wildest science fiction of the past to see the emerging technology of the future. It’s an exciting time to be a consumer.