Mitigation-page

MID-048: Hardware Random Number Generator

Mitigation Tier: Intermediate

Description

Hardware random number generators, sometimes called true random number generators, are pieces of hardware that use environmental noise, such as electromagnetic or thermal data, to create random numbers. Since these devices use local data that is constantly varying to create their random numbers, it is very difficult to recreate the environment in which the number was generated. Therefore, hardware random number generators can be used to create keys that have a high degree of entropy for their seeds and themselves have a high degree of randomness.

Note: Implementors should be sure to verify that the hardware RNG they are considering produces a random stream of sufficient cryptographic quality for use in key generation and not simply a hardware implementation of a lower quality pseudo-random number generator (PRNG) algorithm.

IEC 62443 4-2 Mappings

  • CR 4.3 - Use of cryptography 

References

[1] C. Hoffman. “How Computers Generate Random Numbers.” howtogeek.com. Accessed: Aug. 28, 2024. [Online.] Available: https://www.howtogeek.com/183051/htg-explains-how-computers-generate-random-numbers/

[2] C. Shaw. “Hardware Random Number Generators.” Cerberus Security Labs. Accessed: Aug. 28, 2024. [Online]. Available: https://cerberus-laboratories.com/blog/random_number_generators/