I need a true random number generator web service

Question

I need a way to get non-deterministic random numbers on demand for my application.

However i do not wish/have the capabilities to build the hardware myself, thus I'm looking for a web service which does just that.

Basically I'm looking for a non-deterministic random number generator for my application.

Apparently my requirements is that it definitely have to take the analog world as input.

I've found one at http://random.org. It is good enough for me, However it has a cap of 200k bits (only 6250 32-bit integers!) on each IP per day.

6250 integers per day is definitely not enough for my app. So I'm searching for one that gives a better quota.

I don't mind paying to use the service (but obviously a free one would be better).

I'm not asking a useless question. In fact, applications like online Casinos will need many non-deterministic random numbers on demand. In my situation, my economics/investment game requires a true random number for good simulation. A pseudo-random number is just "not good" enough for a "good" simulation you see.

Btw please do not tell me that a pseudo-random number generator would "be good enough" for my application. It apparently isn't good enough for my situation here, which is the first, last, and only reason why I'll need a non-deterministic random number generator.

Anyway, I'm aware that any data sent through HTTP/HTTPS has risks of being eavesdropped. I'm perfectly fine with that. I need a true random number. After I've gotten the number, I'm happy. A spy can eavesdrop all he wants and I won't mind a bit.

Answer 1

Maybe this one.

http://qrng.physik.hu-berlin.de/

From the site:

We provide a new quantum random number generator (QRNG) based on the quantum randomness of photon arrival times. It promises provable and long term statistical quality, speed as well as affordability. Our design creates a new quality in the sense that it offers substantially higher bit rates than previous solutions available to the public. This has become possible by exploiting most recent photon timing instrumentation and state-of-the-art data processing in hardware.

In addition to providing high speed (up to 150 Mbits/s over USB), the post-processing algorithm applied to the raw data is based on solid predictions from information theory which guarantee conservation of randomness. This allows for the use of the delivered random numbers in unconditionally secure encryption schemes.
[...]
Access Policies
None of the served data is delivered more than once, neither to a single user nor across > independent users. Using the service is free of charge, but requires registration.

Answer 2

What you are asking for is Holy water, and you are rejecting the suggestion that you use regular water. The only reason for preferring Holy water over water is religious. There are simple, randomly-seeded PRNGs that cannot be distinguished from true physical randomness by any known process. And these systems are non-deterministic.

A real-world computer has several sources of true physical randomness. For example, a modern x86 CPU has a 'TSC' which measures the instruction cycle count (and thus, indirectly, the time to a resolution of a billionth of a second or so).

You can capture the TSC when a network packet arrives. The low bits of the TSC will depend on the precise offset between the crystal oscillator that times the network interface and the crystal oscillator that runs the CPU. This is dependent on microscopic zone temperature variations in the two quartz crystals that are believed to be truly random.

Similarly, you can capture the TSC when data arrives from the hard drive. The low bits are dependent on turbulent airflow shearing between the hard drive surface and the case. This is also believed to be truly random.

Well-known algorithms, such as the one the Linux kernel uses (developed by Theodore Ts'o based on the work of M. Matsumoto and Y. Kurita) use the avalance effect to convert a few unpridictable bits into a much larger number. The only differences between the outputs of these algorithms (assuming they are properly seeded by TSC data) and the output of true physical randomness is religious -- no known method can distinguish these outputs. There is no test that one will pass and the other will fail.

I have developed random number generators for online casino use that have achieved independent certification. These methods are the ones used in the real world.

Answer 3

I still don't understand why a cryptographic PRNG isn't good enough for your problem. A defining property of a crypto-PRNG is that it's not possible(with reasonable amounts of hardware) to distinguish its output from a true RNG.

This means it is good enough for any kind of simulation or application I can think of, apart from generation cryptographic keys or initializing the crypto PRNG itself(it obviously needs a few hundred bits of true entropy to get started).

On the other hand webservice RNGs can't be used for crypto either since

1. You can't prove they are actually a true PRNG since you can't distinguish their output from a PRNG
2. You need to trust the operator of the service
3. The random data is transmitted to you over lower security channel. An attacker who can break a PRNG can break SSL too.

So I can't think of a single use where one would prefer a webservice RNG over a good PRNG. If you truly need real and secure random numbers I see no alternative to building hardware yourself.

Answer 4

Several years ago you could call SGI's lavarand which generated random numbers by using the current blob shape and postion of a lava lamp being watched by a webcam.

Though it's gone now you can easily create your own generator with a webcam and the open source code from the fine folks at LavaRnd. It turns out that you don't need the lava lamp at all: the noise picked up by the CCD while the webcam is sealed in a light-proof container is a great source for generating cryptographically sound random numbers.

(I know this isn't a service you can use now, but because it used to be, because it was so cool, and because you can create a nearly free one very easily, I figured it was worthy of being an answer.)

Answer 5

Open a TCP connection to any host/port and count the number of nanoseconds it takes. There's your random number.