True Random Number Generation on an Atmel AVR Microcontroller

Josef Hlav´ c, R´ bert L´ rencz aˇ o o Faculty of Information Technology Czech Technical University in Prague Kolejn´ 550/2, 160 00 Praha, Czech Republic ı Email: {josef.hlavac,robert.lorencz}@fit.cvut.cz Martin Had´ cek aˇ Faculty of Electrical Engineering Czech Technical University in Prague Technick´ 2, 166 17 Praha, Czech Republic a Email: hadacmar@fel.cvut.cz

Abstract—We present a method of generating true random numbers on an Atmel AVR microcontroller. The jitter of the built-in RC oscillator is used as the source of entropy to generate 8 random bits per second. When implemented on the AVR Butterfly demo board, our method needs no external components; otherwise, only an external oscillator is needed. We tested the generated random bitstream using the “sts” test suite by NIST and discuss the result. Finally, we suggest a possible way of generating slightly more entropy and a method of avoiding external components altogether.

I. I NTRODUCTION Random number generation is a frequent requirement in embedded applications. Random numbers are used, for example, to control the behavior of computer-controlled opponents in computer games, to simulate dice throwing, or to generate cryptographic keys. The mentioned uses require various degrees of randomness. In some situations, it is sufficient to use a pseudo-random generator whose output is deterministic but difficult to predict by a human. In other situations, such as in cryptographic applications, generated bits must be truly random, otherwise the security of the entire application could be compromised. In this paper, we present a method of generating true random bits on an Atmel AVR microcontroller [1]. Although the AVR series of 8-bit microcontrollers is not equipped with dedicated hardware random number generation facilities, we show that it is possible to get entropy from the built-in RC oscillator. We demonstrate our method on an AVR Butterfly demo board [2] with no extra components or modifications. II. R ANDOM NUMBER GENERATION The ATmega169 microcontroller [1] on the AVR Butterfly demo board [2] can access several oscillators. The default configuration uses an on-chip RC oscillator for the system clock, and can utilize an oscillator with an externally connected crystal as an asynchronous clock generator for the Timer/Counter 2 unit. There is also another built-in oscillator dedicated for the watchdog timer, which we do not use in our design (but discuss its possible use later in this paper). These oscillators are never perfectly stable. Their frequencies are influenced by many physical factors, such as the the supply voltage or ambient temperature, and also subject to inherent jitter. It is important to note that the effect of these

Fig. 1. Principle of operation. The inherent jitter of the RC oscillator leads to a different count being read in each interrupt handler invocation.

factors is significantly different on each of the oscillators. The crystal oscillator is much more stable in the entire range of operating conditions, while the RC oscillator, although calibrated, exhibits significant variations. Even if the board is kept in a stable environment and powered from a stabilized source, the RC oscillator exhibits easily measurable jitter. The jitter of the RC oscillator is the source of entropy in our method. We use the crystal oscillator to time a constant period (1 second), and we count the number of cycles of the RC oscillator that occur during that time. In an ideal world, the cycle count would always be the same; however, in reality, we observed a difference of up to 212 clock cycles between successive measurements (0.2% of the total number of clock cycles). Now, to generate the actual random bits, we use the following method. The Timer/Counter 1 unit counts the cycles of the system RC oscillator (running at the default setting of 2 MHz). The Timer/Counter 2 unit with the crystal oscillator (32.768 kHz) and an appropriate prescaler configuration is used to generate an interrupt every 1 second. In the interrupt handling routine, the 16-bit value in the Timer/Counter 1 register TCNT1 is read (that is, the number of clock cycles counted modulo 216 ) and the TCNT1 register is reset to zero. Then, bits 1 through 8 are extracted from the retrieved 16-bit value and output as a part of the generated random bit stream. The interrupt handler then exits. The principle of operation is depicted in Fig. 1.

978-1-4244-6349-7/10/$26.00 c 2010 IEEE

V2-493

the operation of the Input Capture unit interfered with the operation of the LCD.01 threshold.0005 0. The watchdog timer is essentially a counter that is clocked with an independent on-chip RC oscillator. These values are then concatenated to form the random bit stream. two distinct Gaussian-like distributions are present.0006 0. Relative frequencies of extracted 8-bit values. avoiding the mentioned drawback and gaining one additional truly random bit. and a reset is triggered as soon as the counter overflows. The primary purpose of the watchdog timer is to reset the microcontroller if the firmware stops working properly.004 0. and several out of many instances of the “NonOverlappingTemplate” test. Therefore. the least significant bit of the retrieved timer value must be discarded because it is not sufficiently random.0001 0 0x0 0x4000 0x8000 0xC000 0xFFFF Fig. hence.0b suite described in [5]. it is assumed that the software is not functioning correctly. IV. each under somewhat different ambient conditions. we tested the final bitstream obtained by extracting bits 1–8 from each measured value. These were the “Universal” test [6]. Then. one can expect 1 in 100 tests to fail even if the tested sequence is actually random [5].003 0. with still not enough data to complete the “Universal” test. one could connect the Output Compare output of the asynchronous Timer/Counter 2 unit to the Input Capture input of the Timer/Counter 1 unit. R ESULTS . This way. Relative frequencies of generated “raw” values (cycle counts modulo 216 ). S UGGESTIONS FOR FUTURE WORK A. we did not explore this option further. In order to do that. In an extreme case.0. B. III. The distribution looks sufficiently uniform now. the results should be still OK because at the 1% level of significance. Software must periodically reset the counter. when the code does nothing but wait for interrupts in an infinite loop. the current instruction must be completed. TESTS AND DISCUSSION For all tests. if it fails to do so. which failed due to insufficient length of the random sequence. Fig. So.0003 0. Bit 9 is still non-random (still many P-values are below the 0. Unfortunately. some randomness tests still failed. the results show that bits 15–10 are obviously non-random – many P-values are below the 0. Fig. and V2-494 2010 2nd International Conference on Computer Engineering and Technology [Volume 2] . This is due to the fact that the test data were obtained in two test runs.0004 0. one could utilize the main RC oscillator and the watchdog RC oscillator to generate entropy. we used the NIST sts-2. The results were again satisfactory. Data in the graph were concatenated from two test runs under somewhat different operating conditions. 0. it is necessary to determine which bits of each measured value are sufficiently random. As expected. Thus. In the latter case. For the remaining bits 1–8. It is important to realize that bit 0 (the LSB) is also nonrandom. some AVR microcontrollers can generate an interrupt when the watchdog timer overflows. Notice that the graph shows two distinct Gaussian-like distributions.01 threshold). This is due to the fact that the value of Timer/Counter 1 is read in an interrupt handler. making the LSB highly dependent on the code being executed. the microcontroller only executes RJMP instructions. on the ATmega169 microcontroller.005 0. Watchdog timer All Atmel AVR microcontrollers are equipped with a watchdog timer. Input capture unit As mentioned above. each of which takes 2 clock cycles.001 0 0x0 the LSB stays constant. this method would require one additional external component – a wire connecting the ICP1 and OCR2A pins. The resulting 16 bitstreams were then tested. it would be possible to access the exact value in the TCNT1 register at the very moment of timer 2 overflow. 3. Their distribution is sufficiently uniform. Obviously. 2.002 0.0002 0. This is due to the fact that before an interrupt can be serviced. 2 shows the “raw” data – relative frequencies of individual encountered values. 3 shows the relative frequencies of 8-bit values extracted from each 16-bit count. Most AVR instructions take 1 or 2 clock cycles to complete. Instead of system reset. on our testing platform. This method would need no external components besides the microcontroller itself. the ICP1 signal shares a physical pin with the SEG22 signal (LCD segment 22). To avoid this problem. 0x40 0x80 0xC4 0xFF Fig. we tested bitstreams created by extracting a specific bit from each measured 16-bit value. First. and simply looking at the file one finds long runs of 1’s or 0’s.

[Online].” Document No. [Volume 2] 2010 2nd International Conference on Computer Engineering and Technology V2-495 . especially ambient temperatures. Available: http://csrc.0b test suite [5]. no. 4271C-AVR-04/05. V.html [6] U. “The Marsaglia Random Number CDROM. [Online].duke.edu/∼ rgb/General/dieharder. 2.edu/pub/diehard/ [5] A. It would also mean losing the built-in watchdog functionality. 2005. NIST Special Publication 800-22rev1. atmel.M. “A Universal Statistical Test for Random Bit Generators. Rukhin et al. “A Statistical Test Suite for the Validation of Random Number Generators and Pseudo Random Number Generators for Cryptographic Applications. “AVR Butterfly Evaluation Kit – User Guide. However.pdf [3] R. 5. it needs to be verified whether the two oscillators are really independent (ruling out any parasitic dependencies) and how much entropy can be generated. 1985. 1992. and that will still take some time to generate using our generator.com/ dyn/resources/prod documents/doc8018.” National Institute of Standards and Technology. 8018N-AVR-08/09.nist. one must remember that AVR microcontrollers have no dedicated facilities for generating true random numbers.pdf [2] Atmel Corporation.” [Online].atmel. 2009. pp. vol. with The Diehard Battery of Tests of Randomness. Indeed. We tested the randomness of the generated bitstream using the NIST sts test suite. Available: http://www. more testing needs to be done before making final conclusions about the properties of the generator. at least while generating random numbers. 89–105.” Florida State University. ATmega169PV. The reasoning behind this idea is that certain fluctuations in the generated clock signal may average themselves out over a longer period. [Online]. Diehard [4] and Dieharder [3].” Document No. We also attempted to test the generator with two other popular test suites. however. Available: http://www. with satisfactory results. The method generates 8 random bits per second.fsu. 2008. the random number generator should be tested under a wider range of operating conditions. C ONCLUSION We presented a method of generating true random numbers on an Atmel AVR microcontroller. Maurer.On the other hand. Available: http://www. We did not test this method yet because the ATmega169 microcontroller in our testing platform does not support watchdog interrupts. “8-bit AVR Microcontroller with 16K Bytes InSystem Programmable Flash ATmega169P. and up to 2 GB for dieharder). we tested the random number generator using the NIST sts-2. “Dieharder: A Random Number Test Suite. Marsaglia.php [4] G. That is not much. these test suites need a lot of data (10 to 11 megabytes for Diehard.” Journal of Cryptology. Brown. R EFERENCES [1] Atmel Corporation. Available: http://www.G. [Online].gov/groups/ST/toolkit/rng/documentation software. C. More testing As mentioned in Section III. In addition.stat. preliminary experiments do suggest that a shorter interval may perform better.com/dyn/resources/prod documents/doc4271.phy. however. It also remains to be fully tested whether a shorter sampling interval (less than the presently used 1 second) may lead to more entropy.