The hidden champion of online privacy is the random number. When you're making a credit card purchase online or simply sending an email, you rely on encryption techniques that use long strings of random numbers to conceal your information. But there's a big problem with this approach: True randomness is incredibly difficult to create digitally. Computers are not random.
"It's actually impossible for a computer, following a predefined algorithm, to generate a truly random number," says Bruno Sanguinetti, as physicist at the University of Geneva in Switzerland. And any technique to try to get a machine to spit out a random number is duplicable, leaving room for someone to crack the code to the random number generator and get to your data.
"Rather, if you want to generate proper random numbers, you must rely on some randomness that originates from the outside world," Sanguinetti says.
The gold standard for this are methods that rely on the bizarre, probabilistic world of quantum mechanics, the counterintuitive physics of tiny things. Unfortunately, all of today's methods that perform quantum random number generation (QRNG) are expensive and require bulky lab equipment.
However, Sanguinetti and his colleagues have just developed a simple, inexpensive QRNG method which relies on little more than an obsolete Nokia cellphone and a light. Yes. You read that correctly.
Paperweight, or Cryptographic Tool?
In an upcoming article in the journal Physical Review X, Sanguinetti and his colleges outlined their method to produce 1 megabit of random numbers per second, and they do it by exploiting the randomness inherent in light itself. According to quantum mechanics, it's impossible to predict exactly when an atom will emit a particle of light. And over a given amount of time, the exact number of light particles any light source will produce is also inherently random.
With that in mind, the physicists took a Nokia N9 and shined a laser on its 8-megapixel camera lens. Like any modern camera phones, the discontinued N9 is sensitive enough to detect excruciatingly small changes in light. And because of the natural quantum variation we just mentioned, each pixel of the camera's lens gets smacked a different number of photons at any given time. Using the N9's open source software, the physicists converted the varying pixel data into a digital output. Ta-da: a steady stream of random numbers.
To check their work, the physicists tested this setup on a much better camera: an ATIK 383L, which also has 8 megapixels but is designed for astronomical use. They also pushed their data set past several of the best mathematical assays to see how random their numbers really were.
One line from the upcoming paper says it all: "If everybody on earth used such a device constantly at 1 Gbps, it would take 1060 times the age of the universe for one to notice a deviation from a perfectly random bit string."
How Random Is Random?
"This really shows the potential feasibility for QRNG on a chip," says Feihu Xu, a physicist who specializes in QRNG at the University of Toronto and was not involved in this work. Xu says that all the requisite parts of this technology should be able shrink down to the micro scale (without the need of a bulky Nokia phone). This could lead to a method of easily creating cryptographically-secure random numbers on phones or other mobile devices.
Yet a couple of big questions about this technique linger. For one thing, Xu says, while he does not doubt the robustness of the random number dataset produced by the Swiss team's technique, it may be premature to claim that the technology's randomness is due to quantum behavior. "This is just because no test or method currently exists that can verify how much of randomness can actually be attributed to quantum effects, and not other physical interactions," he says. There's just no way to know for sure.
Secondly, he says, scientists must refine the data extraction method (the step the Swiss team took when they converted the pixel data from the phone into a digital output) before anyone can claim this technology to be purely, truly random—and not just, you know, really, really, 1060 times the age of the universe random.
There is a difference.
