You're Doing IoT RNG Wrong: Cryptographic Entropy in Silicon

The Hidden Flaws in Embedded Cryptographic Randomness

Cryptographic protocols on IoT devices—such as TLS key exchanges and AES encryption—depend entirely on hardware Random Number Generators (RNG) for secrecy.

Auditing Hardware RNG Implementations Across Silicon Vendors

Dan Petro and Allan Cecil audit hardware datasheets and driver libraries from leading IoT microcontroller vendors, uncovering dangerous software integration flaws.

Extracting Static and Zero-Entropy Keys in Production Devices

The authors demonstrate real-world devices where uninitialized RNG hardware registers resulted in devices encrypting traffic with fixed zero-keys.

Verified Best Practices for Secure Embedded Randomness

Petro and Cecil provide developers with verified guidelines for combining hardware jitter entropy with cryptographic pseudo-random number generators (PRNGs).