<p id="isPasted">Creating perfect randomness is surprisingly difficult. Even modern random number generators never generate completely ideal random numbers: small systematic errors can result in some numbers appearing slightly more frequently than others. For many applications, this does not matter. In cryptography, however, even the tiniest deviations can be problematic.</p><p>Now, researchers at ETH Zurich led by Renato Renner and Andreas Wallraff in the Department of Physics have demonstrated how perfect randomness can actually be created using quantum physics. Their results, which they have just published in the scientific journal Nature, represent a milestone in this area of research. </p><p><span class="fr-img-caption fr-fic fr-dib"><span class="fr-img-wrap"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1780068291538-image.imageformat.carousel.dpr2.1775114945+%281%29.jpg" style="width:100%px" class="fr-fic fr-dib" /><span class="fr-inner">A sheep image encrypted using ordinary randomness (center) and certified perfect randomness from the ETH experiment (right). Only perfect randomness turns the image entirely into noise.  (Image: ETH Zurich)</span></span></span></p><h2>Amplification of randomness through quantum measurements</h2><p>“It may seem strange, but it is almost impossible to create a perfect coin or a perfect die”, says Renner. No matter how symmetric and smooth a die is made, after a roll one of its six faces will always point upwards slightly more often. “Even modern random number generators, which are based on quantum mechanical effects like the reflection of photons from beam splitters, are not entirely immune to such a systematic error or ‘bias’”, adds Wallraff. But now Wallraff’s and Renner’s teams have found a way to take imperfect randomness and still extract perfectly random numbers from it. They call their method randomness amplification.</p><p>“This was made possible by an improved so-called Bell-Test with simultaneously high quality and high data rate”, says Wallraff. He and his coworkers use a complex setup that consists of two superconducting chips, which they cool down to very low temperatures close to absolute zero. Each chip represents a quantum bit or qubit, which can take on the states “0” or “1” or any arbitrary superposition of these states. A 30-meter-long tube, which is also cooled down, connects the two chips. Microwave photons can fly back and forth between them, thus creating quantum mechanical entanglement. This means that a quantum measurement on one qubit, which randomly yields the values “0” or “1”, influences automatically and at a distance whether “0” or “1” is measured on the second qubit. The separation of 30 meters ensures that, during the measurement, even at the speed of light no information can be exchanged between the qubits. This would disturb the perfect randomness.</p><p><span class="fr-img-caption fr-fic fr-dib"><span class="fr-img-wrap"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1780068306024-image.imageformat.1286.dpr2.1281914462.jpg" style="width:100%px" class="fr-fic fr-dib" /><span class="fr-inner">Andreas Wallraff and Renato Renner (f.l.t.r.) next to the 30-meter link connecting two quantum chips. Using this experiment, ETH researchers generated certified perfect randomness for the first time. (Image: Kilian Kessler / ETH Zurich)</span></span></span></p><h2>Random for all eternity </h2><p>Wallraff and his team made the choice of the exact type of measurement (or “measurement basis” in technical jargon) on the two qubits depend on an imperfect random number generator. Renner’s coworkers could then amplify the randomness of the measurement results further using a special algorithm. “The resulting sequence of zeros and ones is now really perfectly random, and we can even certify that”, says Renner. He likens this result to crossing a ridge: “The technical improvements allowed us, for the first time, to create random numbers that will remain perfectly random for all eternity – no matter what analytical methods are used to assess their randomness.”</p><h2>An atomic clock for randomness</h2><p>In the long term, this work could play a similar role in digital security as atomic clocks do for timekeeping: a physically certified source of randomness that other systems can rely on. Possible applications range from the encryption of sensitive communications and digital identities to public randomness services for lotteries and blockchain applications. </p><p>Such methods could also become crucial for quantum-secure communications systems. This is because even the strongest cryptographic methods are only as secure as the random numbers on which they are based: the better the randomness, the more robust the encryption – if it is weak, the entire system becomes vulnerable.</p>

Researchers at ETH Zurich have, for the first time, created certifiably perfect random numbers using a quantum experiment. These can be used, for instance, for encrypting messages.

Perfect randomness realised for the first time

<p id="isPasted">As quantum computers advance, they are expected to be able to break tried-and-true security schemes that currently keep most sensitive data secure from attackers. Scientists and policymakers are working to design and implement post-quantum cryptography to defend against these future attacks.</p><p>MIT researchers have developed an ultra-efficient microchip that can bring post-quantum cryptography techniques to wireless biomedical devices, like pacemakers and insulin pumps. Such wearable, ingestible, or implantable devices are usually too power-constrained to implement these computationally demanding security protocols.</p><p>Their tiny chip, which is about the size of a very fine needle tip, also includes built-in protections against physical hacking attempts that can bypass encryption to steal user data, such as a patient’s social security number or device credentials. Compared to prior designs, the new technology is more than an order of magnitude more energy-efficient.</p><p>In the long run, the new chip could enable next-generation wireless medical devices to maintain strong security even as quantum computing becomes more prevalent. In addition, it could be applied to many types of resource-constrained edge devices, like industrial sensors and smart inventory tags.</p><p>“Tiny edge devices are everywhere, and biomedical devices are often the most vulnerable attack targets because power constraints prevent them from having the most advanced levels of security. We’ve demonstrated a very practical hardware solution to secure the privacy of patients,” says Seoyoon Jang, an MIT electrical engineering and computer science (EECS) graduate student and lead author of a paper on the chip.</p><p>Jang is joined on the paper by Saurav Maji PhD ’23; visiting scholar Rashmi Agrawal; EECS graduate students Hyemin Stella Lee and Eunseok Lee; Giovanni Traverso, an associate professor of mechanical engineering at MIT, a gastroenterologist at Brigham and Women’s Hospital, and an associate member of the Broad Institute of MIT and Harvard; and senior author Anantha Chandrakasan, MIT provost and the Vannevar Bush Professor of Electrical Engineering and Computer Science. The research was recently presented at the IEEE Custom Integrated Circuits Conference.</p><p><strong>Stronger security</strong></p><p>A large percentage of wireless biomedical devices, like ingestible biosensors for health monitoring, currently lack strong protection due to the computational demands of existing security protocols, Jang says.</p><p>But the complexity of post-quantum cryptography (PQC) can increase power consumption by two or three orders of magnitude.</p><p>Implementing PQC is of paramount importance, since regulatory bodies like the National Institute of Standards and Technology (NIST) will soon begin phasing out traditional cryptography protocols in favor of stronger PQC algorithms. In addition, some industry leaders believe rapid advances in quantum hardware make <a href="https://thequantuminsider.com/2026/03/25/google-shortens-timeline-for-quantum-safe-encryption-transition/" target="_blank">PQC implementation even more urgent</a>.</p><p>To bring these power-hungry PQC protocols to wireless biomedical devices, the MIT researchers designed a customized microchip, known as an application-specific integrated circuit (ASIC), that greatly reduces energy overhead while guaranteeing the highest level of security.</p><p>“PQC is very secure algorithmically, but making a device resilient against physical attacks usually requires additional countermeasures that pump up the energy consumption at least two or three times. We want our chip to be robust to both security threats in a very lightweight manner,” Jang says.</p><p><strong>A multi-pronged approach</strong></p><p>To accomplish these goals, the researchers incorporated several design features into the chip.</p><p>First, they implemented two different PQC schemes to enhance robustness and “future-proof” their device in case one scheme is later proven to be insecure. To boost energy efficiency, they applied techniques that enable the PQC algorithms to share as much of the chip’s computational resources as possible.</p><p>Second, the researchers designed a highly efficient, on-chip true random number generator. This device continually generates random numbers to use for secret keys, which is essential to implement PQC.</p><p>Their on-chip design improves energy efficiency and security over standard approaches that usually receive random numbers from an external chip.</p><p>Third, they implemented countermeasures that prevent a type of physical hacking attempt, called a power side-channel attack, but only on the most vulnerable parts of the PQC protocols.</p><p>In power side-channel attacks, hackers steal secret information by analyzing the power consumption of a device while it processes data. The MIT researchers added just enough redundancy to the PQC operations to ensure the chip is protected from these types of attacks.</p><p>Fourth, they designed an early fault-detection mechanism so the chip will abort operations early if it detects a voltage glitch.</p><p>Wireless biomedical devices often have erratic power supplies, so they are susceptible to glitches that can cause an entire security procedure to fail. The MIT approach saves energy by stopping the chip from running a doomed procedure to completion.</p><p>“At the end of the day, because of the techniques we utilized, we can apply these post-quantum cryptography primitives while adding nothing to the overhead, with the added benefit of robustness to side-channel attacks,” Jang says.</p><p>Their device achieved between 20 to 60 times higher energy efficiency than all other PQC security techniques they compared it to, with a more compact area than many existing chips.</p><p>“As we transition into post-quantum approaches, providing strong security for even the most resource-limited devices is essential. This work shows that robust cryptographic protection for biomedical and edge devices can be achieved alongside energy efficiency and programmability,” says Chandrakasan.</p><p>In the future, the researchers want to apply these techniques to other vulnerable applications and energy-constrained devices.</p><p>This research was funded, in part, by the U.S. Advanced Research Projects Agency for Health.</p>

Ultra-efficient chip design enables extremely strong cryptography algorithms to run on energy-constrained edge devices.

New chip can protect wireless biomedical devices from quantum attacks

Platform Integrity must be an essential design priority to ensure data protection.


IoT Platform Security Basics and Essentials

<p id="isPasted">A critical flaw in random number generators puts the security of billions of low-cost IoT devices at risk. This means a new approach for generating random numbers is needed, which can be found in extracting entropy from SRAM behaviour. This only requires a software installation, meaning the security systems of billions of devices can be patched without the need to make hardware changes, even in devices that have already been deployed.</p><p>Every day brings news of attacks on devices connected to the Internet of Things (IoT). The number of connected devices in the IoT is rapidly increasing, and the number of attacks on these devices is growing at an even more explosive rate.</p><p>In the first half of 2021, the number of attacks on IoT devices has <a href="https://threatpost.com/iot-attacks-doubling/169224/" rel="noopener noreferrer" target="_blank">more than doubled to 1.5 billion attacks</a> in just six months. Some are high-profile attacks, that gain a lot of media attention, like the <a href="https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-using-compromised-password" rel="noopener noreferrer" target="_blank">Colonial Pipeline hack</a> or new <a href="https://www.theregister.com/2021/08/25/mirai_botnet_critical_vuln_realtek_radware/" rel="noopener noreferrer" target="_blank">botnet attacks</a> in the spirit of Mirai. But there have also been countless attacks on very personal devices such as <a href="https://www.wired.com/story/kalay-iot-bug-video-feeds/" rel="noopener noreferrer" target="_blank">baby monitors</a> and even <a href="https://money.cnn.com/2017/01/09/technology/fda-st-jude-cardiac-hack/" rel="noopener noreferrer" target="_blank">cardiac devices</a>.</p><p>There are some typical areas of weakness in IoT devices that are exploited frequently. Examples like weak passwords, lack of regular patches and updates, insecure interfaces, and insufficient data protection are all too common when it comes to these attacks. However, researchers from Bishop Fox have recently identified a new critical vulnerability of IoT devices that might not be obvious to many of us. Their <a href="https://labs.bishopfox.com/tech-blog/youre-doing-iot-rng" rel="noopener noreferrer" target="_blank">recent study</a> shows that hardware random number generators (RNGs) used in billions of IoT devices fail to provide sufficient entropy.</p><h2>The use of random number generators</h2><p>Protecting IoT connected devices, their communications, and their data requires the implementation of cryptographic systems on these typically low-cost devices. An important building block for these systems is an RNG. Random numbers are important, because for most cryptographic protocols they provide the required unpredictability to fend off potential attackers. For example, encryption keys are created from random numbers to make it impossible for an attacker to guess these keys and break the encryption.</p><p>There are two main ways to create random numbers on a device. In the first approach, random numbers are generated by a truly random physical source on the device that provides enough randomness to serve all cryptographic protocols that need to run on a device.</p><p id="isPasted">However, a relatively large number of random bits are required for most typical security purposes, and there are very few sources that can meet this requirement.</p><p>The second way to generate random numbers is to combine a truly random source with a limited random-bit output with a cryptographically secure (deterministic) algorithm that can generate many random bits based on the limited amount of entropy of the physical source. Here, the physical source is used to provide a truly random seed, which is then used as input for a deterministic algorithm that generates many random bits.</p><h2>The problem: predictable secrets</h2><p>The study by Bishop Fox shows that there is a critical vulnerability in RNGs used in billions of IoT devices. In these devices the physical source fails to generate sufficient entropy, which leaves the deterministic algorithm with too little randomness to create a strong random output. This compromises the entire RNG solution and puts the devices at risk of attacks, as the random numbers employed become “guessable.” When random numbers become predictable, the foundation of many cryptographic algorithms is severely compromised. Secret keys will lose their strength, leading to broken encryption.</p><p>This needs a new way to solve this problem of insufficient entropy using the typically limited resources of IoT devices. And we need to find a way to implement this solution not only in new IoT devices, but in IoT devices already in the field.</p><h2 id="isPasted">The solution: SRAM as a NIST-certified source of sufficient entropy</h2><p>The solution is to use SRAM as a NIST-certified source of sufficient entropy.&nbsp;It turns out that a component that is present on virtually any device, even the ones with limited resources, can be utilized as a physical source of randomness: the SRAM memory.</p><p>Whenever a chip is powered, its SRAM fills with a random pattern of 0s and 1s. This powerup pattern is unique for that specific chip and can be used as a device identifier, a known principle which is called a <a href="https://www.intrinsic-id.com/physical-unclonable-function/" rel="noopener noreferrer" target="_blank">Physical Unclonable Function (PUF)</a>. However, every individual powerup of the same chip has a certain amount of noise – unstable bits – in this unique pattern. Research from Intrinsic ID has shown that by harvesting this noise in the powerup behavior it is possible to extract sufficient entropy to create a strong seed that can be used as the basis for an RNG solution. Given that SRAM is part of most chips, extracting entropy from something that is already available has great cost advantages, as no additional hardware is required.</p><p>Intrinsic ID has used this concept in <a href="https://www.intrinsic-id.com/products/zign-rng/" id="isPasted" target="_blank">Zign™ RNG</a>, which has successfully completed the RNG certification process by an independent accredited laboratory according to the NIST SP 800-90 standard defined by the National Institute of Standards and Technology (NIST). The true random seed of Zign RNG is harvested from the noise in SRAM using a construction that follows the NIST SP 800-90B specification, while the deterministic algorithm for increasing the number of available random bits is implemented as specified in NIST SP 800-90A.</p><p>The result is a solution for generating random numbers that is both cryptographically secure as well as low-cost, which makes it perfectly suited for the rapidly growing IoT. And most importantly, Zign RNG is implemented completely in software, making it the only hardware entropy source that does not need to be loaded at silicon fabrication. Zign RNG software can be installed later in the supply chain, and even retrofitted on already-deployed devices. This enables a never-before-possible “brownfield” deployment of a cryptographically secure, NIST-certified RNG.</p><p>For more information about Zign RNG, please visit the <a href="https://www.intrinsic-id.com/products/zign-rng/" id="isPasted" target="_blank">product’s webpage</a>. Further explanation of the technology behind the product can be found in <a href="https://www.pufcafe.com/puf-cafe-episodes/#Episode6" target="_blank">this webinar</a> on the topic.</p>

A critical flaw in random number generators puts the security of billions of low-cost IoT devices at risk. This means a new approach for generating random numbers is needed, which can be found in extracting entropy from SRAM behaviour.

encryption

Latest Posts

Perfect randomness realised for the first time

New chip can protect wireless biomedical devices from quantum attacks

IoT Platform Security Basics and Essentials

An Unexpected IoT Problem: Not Enough Randomness