Question

Let us assume we’re generating very large (e.g. 128 or 256bit) numbers to serve as keys for a block cipher.

Let us further assume that we wear tinfoil hats (at least when outside).

Being so paranoid, we want to be sure of our available entropy, but we don’t entirely trust any particular source. Maybe the government is rigging our coins. Maybe these dice are ever so subtly weighted. What if the hardware interrupts feeding into /dev/random are just a little too consistent? (Besides being paranoid, we’re lazy enough that we don’t want to generate it all by hand…)

So, let’s mix them all up.

What are the secure method(s) for doing this? Presumably just concatenating a few bytes from each source isn’t entirely secure — if one of the sources is biased, it might, in theory, lend itself to such things as a related-key attack, for example.

Is running SHA-256 over the concatenated bytes sufficient?

(And yes, at some point soon I am going to pick up a copy of Cryptography Engineering. :))

Answer 1

Using a hash function is a good approach – just make sure you underestimate the amount of entropy each source contributes, so that if you are right about one or more of them being less than totally random, you haven’t weakened your key unduly.

This isn’t dissimilar to the approach used in key stretching (though you have no need for multiple iterations here).