TWC: Medium: Collaborative: Black-Box Evaluation of Cryptographic Entropy at Scale

生成随机数——掷硬币——的能力对于许多计算任务至关重要，从蒙特卡洛模拟到安全通信。建立这样的子系统来产生随机数的理论是很容易理解的，但是理论和实践之间的差距是惊人的大。正如今天所构建的那样，这些子系统是不透明和脆弱的。这些子系统中的缺陷可能危及数百万Internet主机的安全。该项目将开发黑盒技术，用于在互联网规模上寻找与随机性相关的熵失效。这些技术建立在编程语言、操作系统、网络、安全性和密码学的基础上，然后将被应用于对随机数生成漏洞的状态进行系统的、持续的普查。通过这种普查，该项目可以分析部署的网络系统的“长尾”，而不是先验地选择少数几个。该项目将开发和传播防御性分析工具，帮助程序员在发布代码之前调试和纠正代码中的熵问题。它将产生加密对策和熵收集子系统，提供比现有系统更好的安全保证，减少那些熵失败的影响。结果将是更好地理解熵和更值得信赖的系统，无论是现在还是将来。

The ability to generate random numbers -- to flip coins -- is crucial for many computing tasks, from Monte Carlo simulation to secure communications. The theory of building such subsystems to generate random numbers is well understood, but the gap between theory and practice is surprisingly wide. As built today, these subsystems are opaque and fragile. Flaws in these subsystems can compromise the security of millions of Internet hosts.This project will develop black-box techniques for finding entropy failures at Internet scale related to randomness. These techniques, which build on programming languages, operating systems, networking, security, and cryptography, will then be applied to perform a systematic, ongoing census of the state of random number generation vulnerabilities. Through this census, the project can analyze the "longtail" of deployed networked systems rather than a handful chosen a priori.The project will develop and disseminate defensive analysis tools that will help programmers debug and correct entropy problems in their code before they ship it. It will produce cryptographic countermeasures and entropy-gathering subsystems that provide better security guarantees than existing systems, reducing the impact of those entropy failures that do slip through.The result will be a better understanding of entropy and more trustworthy systems, today and in the future.