My G+ Profile
« August 12, 2003 | Main | August 14, 2003 »
August 13, 2003
LavaRnd: Truly Random Numbers
Truly random numbers are crucial to good encryption. Most people have heard of Silicon Graphic's use of Lava Lamps to generate random numbers. There were some problems: it required special SGI hardware and software along with six lava lamps. SGI developed one of the best FAQs on lava lamps around as a result. What's more, the solution wasn't portable. But the biggest drawback was that SGI patented the idea so it wasn't freely available. Now, some of the scientists behind the SGI random number system have created LavaRnd, an open source project for creating truly random numbers using inexpensive cameras, open source code, and inexpensive hardware.
The system uses a saturated CCD in a light-tight can as a chaotic source to produce the seed. Software processes the result into truly random numbers in a variety of formats. The result is a random number that is crytographically sound, ranking at the top of its class in the NIST 800-22 Billion bit test. Its even portable, so the truly paranoid can take it with them when they travel. I've got an old Logitech camera hanging around. Maybe I'll try building one.
05:29 PM | Recommend This | Print This
Identity Management in a Business Context
Related to my post on business context security yesterday is this excellent whitepaper from PirceWaterhouse and Gartner on identity management. They list the following components to an IM solution:
- Enterprise information architecture
- Permission and policy management
- Enterprise directory services
- User authentication
- User provisioning and workflow
I'd add a hearty amen. You can't manage the security of your enterprise in a business context without an enterprise architecture, good policies, global namespaces, the ability to authenticate users systematically, and a good way to manage account provisioning and deprovisioning.