A Guideline on Pseudorandom Number Generation (PRNG) in the IoT

TL;DR

This paper provides guidelines for implementing pseudorandom number generators in IoT devices, analyzing security, performance, and suitability of current hardware and software options to support secure and efficient randomness.

Contribution

It offers a systematic evaluation of IoT hardware and software RNGs, along with recommendations for building secure and efficient random subsystems in constrained IoT environments.

Findings

Hardware components vary in randomness quality

Software generators differ in performance and security

Clear recommendations for RNG implementation in IoT

Abstract

Random numbers are an essential input to many functions on the Internet of Things (IoT). Common use cases of randomness range from low-level packet transmission to advanced algorithms of artificial intelligence as well as security and trust, which heavily rely on unpredictable random sources. In the constrained IoT, though, unpredictable random sources are a challenging desire due to limited resources, deterministic real-time operations, and frequent lack of a user interface. In this paper, we revisit the generation of randomness from the perspective of an IoT operating system (OS) that needs to support general purpose or crypto-secure random numbers. We analyse the potential attack surface, derive common requirements, and discuss the potentials and shortcomings of current IoT OSs. A systematic evaluation of current IoT hardware components and popular software generators based on well-established test suits and on experiments for measuring performance give rise to a set of clear recommendations on how to build such a random subsystem and which generators to use.