TWC: Medium: Collaborative: Black-Box Evaluation of Cryptographic Entropy at Scale

从蒙特卡洛模拟到安全通信，生成随机数的能力--即掷硬币--对于许多计算任务至关重要。建立这样的子系统以产生随机数的理论是众所周知的，但理论和实践之间的差距令人惊讶地大。就像今天建立的那样，这些子系统是不透明和脆弱的。这些子系统中的漏洞可能会危及数百万互联网主机的安全。该项目将开发黑盒技术，以寻找与随机性有关的互联网规模的熵故障。这些技术建立在编程语言、操作系统、网络、安全和密码学的基础上，然后将被应用于对随机数生成漏洞的状态进行系统、持续的普查。通过这次普查，该项目可以分析已部署的网络系统的“长尾”，而不是少数选择优先级的系统。该项目将开发和传播防御性分析工具，帮助程序员在发布代码之前调试和纠正代码中的熵问题。它将产生加密对策和熵收集子系统，提供比现有系统更好的安全保证，减少那些确实漏掉的熵故障的影响。结果将是更好地理解熵和更值得信赖的系统，无论是现在还是未来。

The ability to generate random numbers -- to flip coins -- is crucial for many computing tasks, from Monte Carlo simulation to secure communications. The theory of building such subsystems to generate random numbers is well understood, but the gap between theory and practice is surprisingly wide. As built today, these subsystems are opaque and fragile. Flaws in these subsystems can compromise the security of millions of Internet hosts.This project will develop black-box techniques for finding entropy failures at Internet scale related to randomness. These techniques, which build on programming languages, operating systems, networking, security, and cryptography, will then be applied to perform a systematic, ongoing census of the state of random number generation vulnerabilities. Through this census, the project can analyze the "longtail" of deployed networked systems rather than a handful chosen a priori.The project will develop and disseminate defensive analysis tools that will help programmers debug and correct entropy problems in their code before they ship it. It will produce cryptographic countermeasures and entropy-gathering subsystems that provide better security guarantees than existing systems, reducing the impact of those entropy failures that do slip through.The result will be a better understanding of entropy and more trustworthy systems, today and in the future.