This design is an "Infinite Noise Multiplier", a hardware true random number +generator. The name was inspired by my daughter, who is a never ending source +of randomness.
+ +The idea is simple: there is noise in every system. All you have to do is +amplify it. This switched-cap circuit has a voltage V, which it multiplies by +2 every cycle. If V is greater than Vref/2, then it subtracts Vref/2, thus +keeping V between 0 and Vref/2. The truly random output bit is just the output +of the comparator between V and Vref/2.
+ +This is best understood digitally. If you have a random value between 0 and +1, say .1001110110001, then this circuit would multiply by 2, getting +1.001110110001X, where X is some new random noise. It would subtract out 1 +because the value is > 1, and if X is 0, we get: 0.0011101100010. Continuing +this process, we shift out the bits one at a time, while noise creates random +data in the least significant bits. The circiut is insensitive to non-random +signal injection. If you add a non-random signal to the value, you get +different, but still random bits shifting out.
+ +There is a bit more to it than this. The voltage followers can only drive +down to about 0.1V, which is good, because it creates a voltage to start +multiplying. The multiplier only multiplies by about 1.8 instead of 2, which +is also good, for keeping the voltage from running away. We subtract slightly +less than Vref/2 so that V is always between about .2V and Vref/2V. The +voltage followers introduce significant distortion and voltage offset. All +this results in non-perfect random output. From SPICE simulations it seems +that there may be a 25-ish% correlation between bits (this requires more +analysis), and a 10-ish% bias for more 1's than 0's. To get high quality random +data out, I have to XOR many of these partially random bits together. Here is +the math to support this approach:
+ +Let b represent the maximum amplitude of a bias/correlation function between +bits so that the probability of an attacker guessing correctly an output bit +knowing all the surrounding bits is no higher than 0.5 + b. As I XOR these +bits together, the probability of being able to guess the bit drops. Call the +max amplitude of the bias/correlation when XORing n bits together B(n). Let +P(n) be the probability of an attacker correctly guessing the output bit with +n bits XORed together. Then:
+ +
+P(n+1) = (.5 + b)(.5 + B(n)) + (.5 - b)(.5 - B(n)
+P(n+1) = .5 + 2*b*B(n)
+B(n+1) = 2*b*B(n)
+B(n) = (2*b)^n*b
+
I am XORing 80 bits together. With b = .25, B(80) = 2e-25, which should be more than +adequate for any crypto purposes. However, I still recommend that the output of this RNG +be further randomized with a cryptographically strong pseudo random number generators or +hash function, just to be sure.
+ +I am implementing this design on a tiny .35u mixed-signal IC. It occupies +about 0.04 mm^2, and runs at 8MHz in SPICE simulations. 25 fit per mm^2, cnd +each consumes about a milliwatt. Each outputs 8Mbit/sec, but XORing 80 bits +together reduces it to 100Kbit/sec. Per mm^2, it should generate 2.5Mbit/sec +of crypto ready random bits. This is a very low power process. In a high +speed process, it should be possible to run at 100MHz instead of 8MHz, and the +circuit should shrink dramatically.
+ +Here are my awful hand-drawn schematics. The first schematic shows that on +phase 1 we sample the voltage from the previous cycle, and store it on two hold +capacitors in parallel. An NMOS transistor is used as a switch from the buffer +of the previous stage. During phase 2, we use three more NMOS switches to +stack the two capacitors, which in an ideal world would multiply the voltage by +2, but because of parasitics, it only does about 1.8. The output of the +stacked capacitors feeds through a voltage-follower buffer into the next stage. +Here there are two switchies: one to feed another hold capacitor during phase 2, +and another to feed an almost identical hold capacitor also in phase 2. The +first hold capacitor feeds the positive terminal of a comparator, while Vref/2 +feeds the negative. This is a clocked comparator that compares its inputs on +the start of phase 1. If the held voltage is greater than Vref/2, the +comparator subtracts a charge from the other hold capacitor that causes its +voltage to drop ideally by Vref/2. Due to parasitics it's somewhat less than +this. This second hold capacitor where the subtraction occurs then feeds into +another voltage follwer buffer, which loops back to where we started, so the +process can repeat. The voltage follower schematic is also shown, and is +simply 4 mosfets: two for current sources and a matched diff pair. It is a +standard source-coupled voltage follower. Vref/2 is generated with a simple +resistor divider. The two phases of the clock are generated with back-to-back +NOR gates, which is also standard. The clocked comparator is a standard +circuit as well, which is based on two inverters feeding back on each other, +with some mosfets to reset the inverter outputs to 1 when the input clock is +high, and when it goes low, the inverters are connected, and will flip one way +or the other. Two mosfets driven by the input voltages cause one side or the +other to win. The bias voltage generator for the buffers current sources is +also shown, which is a resistor feeding into a mirror.
+ +
+
+
+
+
+Here is a simulation of 80 clock cycles, showing typical random data that +would be XORed together to generate one output bit. The random output is Q. +The bottom signal is a 1MHz sine wave which is coupled into the hold +cap after buffer1 through a capacitor 10% as large as the hold capacitor. The +point is to show that non-random sources of noise do not cause the output to be +less random. This circuit is highly insensitive to external signals.
+ +
+
+The main sources of noise in this circuit are primarily shot noise and +thermal noise. Shot noise is generated every time an electron is accelerated +through the input transistors of the voltage followers. Thermal noise is +generated in the bias current resistor. However, the source of noise in the +SPICE simulation is the numerical errors in the simulator, which dominate over +the quieter shot and thermal noise. The actual source of noise should not make +any differece. Every analog signal has noise. It simply has to be amplified +for us to use it.
+ \ No newline at end of file diff --git a/infnoise_cmos/RNG5.png b/infnoise_cmos/RNG5.png new file mode 100644 index 0000000..b5a5d57 Binary files /dev/null and b/infnoise_cmos/RNG5.png differ diff --git a/infnoise_cmos/schem1.png b/infnoise_cmos/schem1.png new file mode 100644 index 0000000..50d6d41 Binary files /dev/null and b/infnoise_cmos/schem1.png differ diff --git a/infnoise_cmos/schem2.png b/infnoise_cmos/schem2.png new file mode 100644 index 0000000..aa26d54 Binary files /dev/null and b/infnoise_cmos/schem2.png differ diff --git a/infnoise_cmos/schem3.png b/infnoise_cmos/schem3.png new file mode 100644 index 0000000..8fa05fd Binary files /dev/null and b/infnoise_cmos/schem3.png differ