You're Doing IoT RNG Wrong
Dan Petro evaluates hardware Random Number Generators (RNGs) across popular IoT microcontrollers, exposing broken entropy sources that compromise crypto keys.
Summary
The Critical Dependence of Cryptography on Randomness
Cryptographic protocols—including AES key generation, RSA primes, and TLS nonces—rely entirely on unpredictable random number generators (RNGs) for security.
Auditing IoT Microcontroller Hardware RNGs
Dan Petro conducts rigorous statistical entropy tests across popular IoT silicon platforms (such as ESP32, STM32, and Nordic chips).
Discovering Zero-Entropy and Predictable Seeds
Petro reveals common software integration errors where developers read uninitialized RNG registers, resulting in fixed zero-value encryption keys and predictable nonce generation.
Best Practices for Embedded Cryptographic Randomness
The author provides developers with verified entropy harvesting routines, advising how to combine hardware noise with cryptographic PRNGs safely.
Related talks
IoT Village·40 min
Dan Petro · Allan Cecil
Dan Petro and Allan Cecil uncover systemic flaws in hardware Random Number Generators across IoT chipsets, leading to static zero-value encryption keys.
Live Presentations·45 min
Dan Petro · Allan Cecil
Dan Petro and Allan Cecil present their live research on broken hardware Random Number Generators across IoT chipsets, extracting static zero-keys.
Main Stage·40 min
Reynaldo · nyx
Reverse engineers commercial vape and sound monitoring sensors installed in school restrooms, uncovering unauthenticated telemetry feeds and cloud vulnerabilities.