Problem - Kevin Tafuro

11.21 Gathering Entropy from Mouse Events on
Windows
Problem
You need entropy in a low-entropy environment and can prompt the user to move
the mouse to collect it.
Solution
On Windows, process all mouse events. Mix into an entropy pool the current position
of the mouse pointer on the screen, along with the timestamp at which each
event was processed. Estimate entropy based upon your operating environment; see
the considerations in Recipe 11.19.
Discussion
There can be a reasonable amount of entropy in mouse movement. The entropy
comes not just from where the mouse pointer is on the screen, but from when each
movement was made. In fact, the mouse pointer’s position on the screen can have
very little entropy in it, particularly in an environment where there may be very little
interaction from a local user. Most of the entropy will come from the exact timing of
the mouse movements.
The basic methodology is to mix the on-screen position of the mouse pointer, along
with a timestamp, into the entropy pool. We will provide an example implementation
in this section, where that operation is merely hashing the data into a running
SHA1 context.
The big issue is in estimating the amount of entropy in each mouse movement. The
first worry is that it is common for Windows to send multiple mouse event messages
with the same mouse pointer position. That is easy to thwart, though. You simply do
not measure any entropy at all, unless the mouse pointer has actually changed position.
Ultimately, the amount of entropy you estimate getting from each mouse movement
should be related to the resolution of the clock you use to measure mouse movements.
In addition, you must consider whether other processes on the system may be
recording similar information. (See Recipe 11.19 for a detailed discussion of entropy
estimation.)
The following code captures mouse events, hashes mouse pointer positions and
timestamps into a SHA1 context, and repeats until it is believed that the requested
638 | Chapter 11: Random Numbers
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.