project

CryptoLite-ICE

USB True Random Number Generator  /  iCE40UP5K + RP2040 custom hardware

overview

What is it?

board

The hardware

internals

Entropy pipeline

Entropy is generated inside the FPGA, sampled into the synchronous clock domain and shifted out over SPI. The RP2040 picks it up, runs the continuous health tests, whitens it with SHA-256 and exposes it through a USB Vendor endpoint.

rtl

The entropy source — in Verilog

At the heart of the FPGA design is a cluster of ring oscillators. Each one is a closed loop of LUT-based inverters; their outputs are XOR-reduced to a single bit and registered onto the system clock.

module ro_trng #(
  parameter n_ro = 32
) (
  input  wire clk,     /* 48 MHz system clock */
  input  wire resetn,  /* synchronous active-low reset */
  output reg  rnd_bit  /* one random bit per clk cycle */
);

  wire [n_ro-1:0] ro_out;

  /* n_ro free-running ring oscillators */
  genvar i;
  generate
    for (i = 0; i < n_ro; i = i + 1) begin : gen_ro
      ro_cell u_ro (
        .out(ro_out[i])
      );
    end
  endgenerate

  /* Reduction XOR + sample into the synchronous domain */
  always @(posedge clk) begin
    if (!resetn)
      rnd_bit <= 1'b0;
    else
      rnd_bit <= ^ro_out;
  end

endmodule

Each ro_cell is a small LUT-based ring whose free-running frequency depends on per-die process variation. The internal topology and constraints needed to keep the synthesiser from optimising the ring away are part of the product, and not published here.

hardware

Specifications

indicators

Status LEDs

Two on-board LEDs (LD1 and LD2) encode the firmware state at a glance.

usage

Using it from the host

The board ships with a small Python client built on top of pyusb. Plug it in, install the udev rule once, and you have one binary on your PATH.

protocol

USB Vendor commands

Under the hood the host script speaks a tiny binary protocol over a single Vendor-class interface (two bulk endpoints, 64 B max packet). Useful if you want to integrate the board into an embedded environment without Python.

measurement

Entropy quality

Quick sanity check on a 1 Mbit (125 000 byte) capture taken from a freshly configured board. For production qualification, longer captures should be run through NIST STS or dieharder.