Peer to Peer Entropy Generator (or Random numbers generator with p2p seeding)
Open Issues: 0
- php: >=5.0.0
- apigen/apigen: ~4.1@RC
- phpunit/phpunit: ^6.1
or Random numbers generator with p2p seeding
This class uses a combination of sources of entropy to generate random data as unpredictable as possible. The key concept is sharing of random data between peers, where both peers benefit from the request.
Internally each peer generates random data using some system data, server performance/load, some PRNGs (Pseudo Random Number Generators), timing and client supplied data. The collected data is always combined with the internal state data, which changes at each request, and digested by a HMAC with the peer's secret key.
Each client-peer adds to the entropy of the server-peer by suppling variable data with the request (in purpos or not) and by the fact of connecting to the server (the exact request time is also accounted), thus changing internal state of the
The internal state is the sum of all collected entropy bits from system and from all client-peers that have ever requested current peer.
For client-peer there is no way to know about
P2PEG's internal state or about other client-peers, hence generated data is truly random and unpredictable.
If one peer doesn't trust the other peer to be "honest", it can contact multiple peers to gather the random bits and combine the result with it's own PRN and internal state.
On a web-server entropy can also be collected from common website clients.
Include the class
Get the singleton instance or just create a new instance of P2PEG
$P2PEG = P2PEG::instance();
Get some random binary string
$str = $P2PEG->str($length);
Now you can use
$str as cryptographic salt, seed for PRNG, password generators or anything else
that requires unpredictable hight entropy data.
Get some random integer numbers:
$int1 = $P2PEG->int(); $int2 = $P2PEG->int16(); $int3 = $P2PEG->int32(); $int4 = $P2PEG->rand($min, $max, $algo="int"); // see PHP's rand() in docs
Get some random text (base64 encoded)
$text = $P2PEG->text($length);
Get some random text (by a given alphabet)
$text = $P2PEG->alpha('a-z0-9AUOIE!', $length); // or $text = $P2PEG->text($length, 'a-z0-9AUOIE!');
Get some random string hex encoded
$hex = $P2PEG->hex($length);
Get a pseudo random 32bit integer - this method is faster then int32() for generating lots of numbers, but in turn it uses less entropy (see RNG).
$rand_int = $P2PEG->rand32($strict=true);
Get a pseudo random 64bit integer - this method is faster then int() for generating lots of numbers, but in turn it uses less entropy (see xorshiftplus algorithm).
$rand_long = $P2PEG->rand64();
There are some more PRNGs, randomly seeded by P2PEG:
// x32 $P2PEG->xorShift32($strict=true); $P2PEG->xorShift128($strict=true); $P2PEG->xorwow($strict=true); // default in Nvidia's CUDA toolkit // x64 $P2PEG->xorShift1024Star(); $P2PEG->xorShift128Plus(); $P2PEG->splitMix64();
Before using the instance of
P2PEG class, it is a good idea to set some properties:
Internal state file - optional.
Tip: Keep it inaccessible to other users on system by
chmod 0600 p2peg.dat
$P2PEG->state_file = "/path/to/data/p2peg.dat";
A secret key chosen at setup
$P2PEG->setSecret("some uniq secret that no one knows");
Seed the P2PEG with some bits of data or your choise
$P2PEG->seed("some (random) string");
Seed the PHP's RNG
mt_srand(crc32($P2PEG->seed())); // or mt_srand($P2PEG->int32());
$P2PEG->seedRandomDev("some (optional) entropy");
Get a 56bit integer, if system is x64
$int64 = $P2PEG->int(7);
Display a random bitmap image
Take care of what
$method you allow for
servImg(), cause it could display some private data to client.
The following methods are safe to display to client:
$allowMethods = array( // P2PEG entropy 'int', 'int32', 'int16', 'str', 'seed', 'text', 'hex', // PRNGs seeded by P2PEG 'rand32', 'xorShift32', 'xorShift128', 'xorwow', 'rand64', 'xorShift128Plus', 'xorShift1024Star', 'splitMix64', // raw data 'dynEntropy','clientEntropy','networkEntropy', );
This method helps to visually inspect a random number generator (RNG). It is not enough to know how good the RNG is, but it can tell that the RNG is bad or something is wrong.
Get some entropy from outside
On cron you could call
This method gathers some network entropy and server entropy and can be realy slow. This is why it is a good idea to call it in background. But at the same time, it is a good idea to call it from time to time, to get some more unpredictable, crtypto-safe entropy.
... more comming soon
Example of usage
I've created a simple password generator using P2PEG on both client and server. Each client is seeded by server, and server is seeded by each client, thus implementing P2PEG concept.
To improve the entropy unpredictability, I intend to create system where multiple machines periodically exchange entropy. Each pear gets entropy and gives entropy at the same time with a simple GET request like this one:
curl "https://DUzun.Me/entropy/<HMAC(random_func(), $secret)>"
/dev/randomand update entropy count, to improve system performance
Count the amount of entropy generated
Test the quality of entropy with TestU01