雅特力AT32 MCU的随机数生成

概述

产品和生态系统安全性的需求比以往任何时候都更加重要。真随机数是所有安全系统的核心，其质量会影响设计的安全性。因此在没有内置硬件TRNG的AT32的微控制器系列中，如何提高随机数的有效，来符合应用的需求。底下提供两种方法：提高乱度的方法之一，使用ADC的误差。AT32的微控制器内置最多三个高级12位片上SAR模拟数字转换器（ADC）并提供自校准功能，保证12位ADC静态准确度（accuracy）可达10位以上。这误差可以拿来计算随机数的来源。提高乱度的方法之二，使用上电时SRAM内容的不确定性。SRAM不保证上电时的内容值，每次上电后，内容也是不容易预测的。我们可以利用这个特性，拿来增加随机数的乱度。

利用ADC的误差来源产生随机数的方法

本章介绍了使用软件触发方式触发ADC，配置普通信道和DMA。根据随机数需要的位数来配置信道数，一次转换最多到16信道，将16信道转换的数值可组合计算成一个32位的随机数。底下是DMA和ADC的配置代码。

DMA配置函数代码

ADC配置函数代码

可以看到，代码中并没有对ADC做自校准，转换时间也使用最短的，这种情况下，ADC的准确度会是最差的，有助于乱度的提升。

ADC随机数取得代码

利用上电时SRAM的内容来计算随机数的方式

这范例只是简单的利用累加来获得一个随机数

SRAM配置函数代码

随机生成应用指南

以上两种方式建议应用在上电后执行，因为SRAM内容在运行后会初始化，ADC也会有其他应用上的需求，上电后执行并获得一个随机数，将这个随机数当成Seed，之后可以利用标准C函式库中提供的随机数生成器，产生后续的随机数。
SRAM的方式限定在POR后使用。如果只是一般的reset，SRAM会维持内容，造成产生的随机数都是相同。ADC的方式则没有限制，但是因为使用ADC外设的资源，推荐放在开机时执行，不会影响后续的ADC应用。

范例运行和分析

本篇应用笔记适用于AT32各系列MCU，只要有ADC外设皆可适用。范例固件AN0175_SourceCode_V2.0.0运行在AT32403A AT-START版上，透过 PuTTY（免费开源终端仿真器）等终端仿真应用程序，将数据存储在工作站上。在工作站上编译NIST统计测试集程序包，以生成可执行程序。接下来运行NIST统计测试集程序分析数据以及统计测试。以下是使用范例固件AN0175_SourceCode_V2.0.0在上电后会产生的一个随机数，在收集约319万笔随机数后，进行NIST统计测试。图1. 环境配置

硬件资源

AT32403A AT-START 版

1) 串口(PA9)

具有串口的计算机，运行 Linux 系统

软件资源

下载到AT32403A AT-START版运行

1) AN0175_SourceCode_V2.0.0

计算机端运行

1) 终端仿真器如PuTTY

2) 统计测试集源程序

https://csrc.nist.gov/CSRC/media/Projects/Random-Bit-Generation/documents/sts-2_1_2.zip

https://github.com/usnistgov/SP800-90B_EntropyAssessment

NIST SP800-22b统计测试集

基于NIST统计测试集：April 27, 2010: NIST SP 800-22rev1a (dated April 2010), A Statistical Test Suite for the Validation of Random Number Generators and Pseudo Random Number Generators for Cryptographic Applications, that describes the test suite.统计测试集源程序下载：https://csrc.nist.gov/CSRC/media/Projects/Random-Bit-Generation/documents/sts-2_1_2.zip统计测试集结果：

NIST SP800-90b统计测试集

基于NIST统计测试集：November 21, 2014: NIST requests comments on the latest revision of NIST SP 800-90A, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, which is datedNovember 2014.统计测试集源程序下载：https://github.com/usnistgov/SP800-90B_EntropyAssessment统计测试集结果：需先转换成符合2-bit-wide symbols数据输入格式。./ea_non_iid 0421_2.bin 2 -i -a -vOpening file: '0421_2.bin'Loaded 50888144 samples of 4 distinct 2-bit-wide symbolsNumber of Binary Symbols: 101776288Running non-IID tests...Running Most Common Value Estimate...Bitstring MCV Estimate: mode = 50891714, p-hat = 0.50003507693265448, p_u = 0.50016273956095891Most Common Value Estimate (bit string) = 0.999531 / 1 bit(s)Literal MCV Estimate: mode = 12725005, p-hat = 0.25005834364876817, p_u = 0.25021470996034195Most Common Value Estimate = 1.998761 / 2 bit(s)Running Entropic Statistic Estimates (bit strings only)...Bitstring Collision Estimate: X-bar = 2.5000060058338387, sigma-hat = 0.50000000610486417, p = 0.50989562404154842Collision Test Estimate (bit string) = 0.971726 / 1 bit(s)Bitstring Markov Estimate: P_0 = 0.49996492306734552, P_1 = 0.50003507693265448, P_0,0 = 0.4999425562646943, P_0,1 = 0.5000574437353057, P_1,0 = 0.49998729655651403, P_1,1 = 0.50001270344348603, p_max = 2.9554800761609014e-39Markov Test Estimate (bit string) = 0.999936 / 1 bit(s)Bitstring Compression Estimate: X-bar = 5.2176714331187366, sigma-hat = 1.0152961906603262, p = 0.019654761320726077Compression Test Estimate (bit string) = 0.944830 / 1 bit(s)Running Tuple Estimates...Bitstring t-Tuple Estimate: t = 23, p-hat_max = 0.52357011476148263, p_u = 0.52369763546518522Bitstring LRS Estimate: u = 24, v = 50, p-hat = 0.50053161737274598, p_u = 0.50065927992920534T-Tuple Test Estimate (bit string) = 0.933194 / 1 bit(s)Literal t-Tuple Estimate: t = 11, p-hat_max = 0.27527598152543398, p_u = 0.27543726106146299Literal LRS Estimate: u = 12, v = 24, p-hat = 0.25086994374062016, p_u = 0.25102647882990431T-Tuple Test Estimate = 1.860204 / 2 bit(s)LRS Test Estimate (bit string) = 0.998099 / 1 bit(s)LRS Test Estimate = 1.994089 / 2 bit(s)Running Predictor Estimates...Bitstring MultiMCW Prediction Estimate: N = 101776225, Pglobal' = 0.50008960368099831 (C = 50884239) Plocal can't affect result (r = 26)Multi Most Common in Window (MultiMCW) Prediction Test Estimate (bit string) = 0.999741 / 1 bit(s)Literal MultiMCW Prediction Estimate: N = 50888081, Pglobal' = 0.25014573559900838 (C = 12721480) Plocal can't affect result (r = 12)Multi Most Common in Window (MultiMCW) Prediction Test Estimate = 1.999159 / 2 bit(s)Bitstring Lag Prediction Estimate: N = 101776287, Pglobal' = 0.50019269251081444 (C = 50894762) Plocal can't affect result (r = 25)Lag Prediction Test Estimate (bit string) = 0.999444 / 1 bit(s)Literal Lag Prediction Estimate: N = 50888143, Pglobal' = 0.25015172047634626 (C = 12721800) Plocal can't affect result (r = 13)Lag Prediction Test Estimate = 1.999125 / 2 bit(s)Bitstring MultiMMC Prediction Estimate: N = 101776286, Pglobal' = 0.50008456811129076 (C = 50883757) Plocal can't affect result (r = 27)Multi Markov Model with Counting (MultiMMC) Prediction Test Estimate (bit string) = 0.999756 / 1 bit(s)Literal MultiMMC Prediction Estimate: N = 50888142, Pglobal' = 0.2502104743048289 (C = 12724789) Plocal can't affect result (r = 13)Multi Markov Model with Counting (MultiMMC) Prediction Test Estimate = 1.998786 / 2 bit(s)Bitstring LZ78Y Prediction Estimate: N = 101776271, Pglobal' = 0.50008006313488451 (C = 50883291) Plocal can't affect result (r = 26)LZ78Y Prediction Test Estimate (bit string) = 0.999769 / 1 bit(s)Literal LZ78Y Prediction Estimate: N = 50888127, Pglobal' = 0.25021764352136133 (C = 12725150) Plocal can't affect result (r = 13)LZ78Y Prediction Test Estimate = 1.998745 / 2 bit(s)H_original: 1.860204H_bitstring: 0.933194min(H_original, 2 X H_bitstring): 1.860204