Can I implement a (weak) entropy source in FPGA?

Question

I'm working with an IoT platform in FPGA for evaluation and prototyping. I need to provide support for TLS, and for that I need an entropy source.

I understand that true random noise sources are quite specialist (if even practical) in FPGA, since the device performance is often pretty good (and hard to find any corner-case parameters), but I can implement a pseudo-random sequence generator without any problems.

I only have some standard I/O channels (uart, I2C, etc), nothing that looks like it can provide even much to seed a PRBS - except maybe an audio ADC input. Are there maybe any reliable tricks for generating entropy in an FPGA which I ought to consider?

Assuming that I use a PRBS, I can potentially attach an external noise source which I could certainly use as a seed. I'm interested to know how much this would actually add to my TLS implementation. Would this be reliable and secure, or only slightly better than using a fixed pseudo-random sequence? Would I need to keep polling the external noise source for more entropy?

It's OK if the entropy source I end up with isn't properly crypto-secure (since this is just for prototyping), but I'd like to understand the cost-quality trade-off.

Answer 1

Do you need to? You can implement a cryptographically secure random generator if you have two things: some rewritable secure storage, and an initial seed. That is, it's enough to seed the RNG once, and then save its state and work off the saved state. It isn't ideal, it would be better to mix in entropy periodically, but it's ok, especially for a development protoype.

You do need to have rewritable secure storage. If the device only has ROM and non-secure storage, then this approach is not possible. There must be a location where you can store the RNG state in such a way that your adversaries can neither read it nor modify it.

The way this works is, when the device boots, it loads the current RNG state, and uses it to generate some enough random bytes for twice the size of the RNG state. Write the first half as the new saved RNG state, and use the second half as the initial RNG state for the current session. With any cryptographically secure PRNG, this yields a cryptographically secure PRNG. Note that it's critical that you don't reuse a stored RNG state, that's why you must write a new independent RNG state before you start using the RNG.

The initial entropy injection can happen during manufacturing, or when the device is set up. Usually those things happen with a connection to a PC which can generate the entropy on behalf of the device.