I'm working on a desktop application and would love to use any hardware random number generators that happen to be available, though I dont want the user to have to do any confusing setup to use it. its Java/Clojure based so something in the java world would be nice though I'm willing to work with just about anything. Know of any programs that do this well? are they cross platform?
+2
A:
It depends on the quality of random numbers you need to generate. Specifically, how much entropy do you need?
If you really need some hardcore random numbers that aren't dependent on a predictable clock, you might want to check out the 3rd party generators available.
http://en.wikipedia.org/wiki/Hardware_random_number_generator
Some of these use thermal heat, etc... to increase the entropy of each bit.
Robert Greiner
2009-08-05 20:38:30
The OP's asking how to interface with whatever's available, surely? How does the amount of entropy needed factor in here?
bdonlan
2009-08-05 20:40:00
there are only so many options available in a vanilla machine. I was just letting him know that all random numbers are not created equal, and trying to inform him of some alternatives. My answer may not be exactly what he is looking for, but I think it is pertinent to his problem.
Robert Greiner
2009-08-05 20:42:01
the short answer is "enough to keep my users data safe from all attacks up to but not including torture"
Arthur Ulfeldt
2009-08-05 21:49:13
haha, ok. Then my approach is way too hardcore for what you need. bdonlan has an excellent answer.
Robert Greiner
2009-08-05 22:21:41
+6
A:
You should use the Java SecureRandom class. The user can override the default algorithm selection with a hardware RNG by setting its preference order. This then applies to all Java applications, including yours.
bdonlan
2009-08-05 20:39:18
The corollary is that the app would need a SecureRandom engine class for each device that might "happen to be available". Unless someone out there already maintains a library of such classes for common devices, this is a tall order!
Stephen C
2009-08-05 22:54:06
Or there can be one SecureRandom engine that uses the OS facilities for interacting with hardware RNGs
bdonlan
2009-08-06 01:46:22
@bdolan: I don't think that will work. AFAIK, there are no specific standards for interfacing RNG hardware, and no standard OS-level services.
Stephen C
2009-08-06 09:31:03
Not 'standard' but per-OS. Linux's /dev/random, Window's CryptGenRandom(), etc.
bdonlan
2009-08-06 13:29:54