Detached Raspberry for secure key generation

Question

I need to generate secure encryption keys but don't want to spend a lot of money on a dedicated Hardware Security Module. Would an air-gapped Raspberry with Raspbian be good for the job? Does it create true random numbers or would I need a true random source? Or is it really just a bad idea?

Answer 1

There are two interessting articles about RPi1 integrated RNG (Random Number Generator): http://scruss.com/blog/2013/06/07/well-that-was-unexpected-the-raspberry-pis-hardware-random-number-generator/ and http://fios.sector16.net/hardware-rng-on-raspberry-pi/. I have not checked wheter the subsequent BCM chipsets contain an RNG, but it would be very possible. With this in mind, I would use this. If you really need something like this and would really need to provide very secure key generation, you could do it in this way, however, how would you exfiltrate the keys? With an airgap and complete security, the only way should be Mouse and Keyboard. However - that would only give you an secure key - whose security would be threatend as soon as you write it down in any electronic system. So - it would be useful to create really secure - non tampered - keys - but in the end, you won't be able to keep that security level up as soon as the key hits the real world. There are always possiblites to increase security - but you'll need to make sacrifices for that. And question is, if that is really necessary and if your secure system does not break somewhere down the chain i.e. nearly perfectly random generated keys are useless if i.e. the private key is stolen while it is decrypted :).