AMD 的随机数生成器无法生成 0 吗?
AMD's random number generator can't generate a 0?

原始链接: https://board.flatassembler.net/topic.php?t=24261

基于我在电子工程和汇编语言编程方面的背景,我认为英特尔(Intel)和超威(AMD)的顶尖工程团队完全有能力实现高质量的硬件随机数生成(RNG)。 我目前正在等待 AMD 对一个技术问题的反馈。在我的测试中,两款不同的 AMD 处理器在九天内均未产生过零。为了进一步调查,我更新了测试应用程序,增加了基准测试功能,并增加了对不支持 `rdseed` 指令的浏览器的支持。 我的基准测试显示,处理器之间存在显著且无法解释的性能差异;例如,一款 2012 年的酷睿 i5 生成数字的速度比 2017 年的酷睿 i7 快得多,且对时钟频率的依赖程度各不相同。这些发现表明,不同制造商甚至不同处理器版本之间的 RNG 实现存在巨大差异。尽管进行了分析,但我仍无法找到足够的文档来解释这些 RNG 单元的底层架构。我将与 AMD 保持联系,并在有任何进展时进行分享。

Hacker News 的用户正在讨论有关 AMD Zen 2 处理器的一个漏洞:`RDRAND16` 指令无法生成零值。 讨论的核心要点包括: * **漏洞现状:** 虽然 `RDRAND32` 功能似乎正常,但 Zen 2 芯片上的 `RDRAND16` 在统计学上避免返回零。用户指出,这并非 AMD 首次遇到随机数生成器(RNG)问题;此前的漏洞表现为只返回全 1,这些问题通过微代码更新得到了解决。 * **潜在原因:** 开发人员推测,AMD 可能为了修复早期问题而采取了一种“偷懒”的方案,将零视为错误状态(因为零在其他指令中常被用作熵耗尽的信号),导致硬件直接丢弃该结果并重新生成,而不是将其返回。 * **实际影响:** 专家认为,虽然有偏向的 RNG 存在漏洞,但在 16 位范围内缺失零值不太可能破坏聚合了多个熵源的现代加密系统。不过,用户对硬件层面缺乏一致性和透明度感到不满。 * **安全建议:** 资深贡献者达成共识,即不要依赖单一硬件源。安全的软件应使用加密安全伪随机数生成器(CSPRNG),并混合多种输入(如抖动、系统时间和内核 API)。
相关文章

原文
In addition to being an assembly language programmer, I am also an electronics engineer/technician (with probably "similar level of experience", or even more), and therefore, with knowledge of both areas, I can think of hundreds of different ways of being able to build something that generates random numbers, and of high quality (for example, based on white noise generators, which are the thermal noise of semiconductors, try to predict this with supercomputers). Therefore, I don't think this is by far the most difficult part to do on an x86-64 processor, for the Engineering elite, present in the Intel and AMD teams, for example.

Furthermore, I must say that I have not yet received any further feedback from AMD regarding the case. But they have already escalated my case internally with them, so I am still here waiting for a precise update from them, to share it here. And, since 9 days before posting here, until the present moment, not a single 0 came out of the 2 AMDs that I had access to!

With the new update I made to my application to test this, it is now also possible to benchmark the random number generator, and it is also now possible to run the test on processors that do not have the 'rdseed' instruction. As for the benchmark, it is surprising how different the results are between different processors (e.g.: a Core i5 from 2012 generates 12.6 M numbers per second, while a Core i7 7700 from 2017 generates "only" 750 k numbers per second, and my AMD Ryzen 7 around 2.6 M numbers per second, and the AMD generator being completely inert to clock variation, and the Core i5 from 2012 100% dependent on the clock, as it seemed to me in the tests I did). Which leads me to realize that the random number generator circuit must have large differences, and probably completely different versions/revisions, even for models from the same manufacturer.

So far, I also have not found decent information on how their RNG unit works.

联系我们 contact @ memedata.com