Skip to content

wj-diode-quantum

Collects quantum random numbers from the Australian National University, streams them across a data diode, and serves them one at a time on the protected side. Each value is 1024 bits.

A data diode only carries data one way. That makes it excellent at keeping a network isolated and useless for anything that needs a reply — so a machine behind one cannot simply ask ANU for random numbers. This program splits the job in two: one side collects and pushes, the other side stockpiles what arrives and hands it out on request.

Features

  • Nothing is written to disk — on either side. The numbers exist only in pipes and in memory, so there is nothing to leave behind and nothing to clean up.
  • Both ANU APIs — the current keyed service and the older unkeyed one, each polled on its own schedule sized to its rate limit. Enable either or both.
  • Any diode tool — moving data across the diode is a configured external command reading and writing a stream. diodetool is what this was built against, but nothing about it is hard-coded.
  • Never serves the same number twice — for as long as the server runs, which is as long as the pool exists.
  • Bounded, self-trimming pool — newest served first, oldest discarded at capacity, so memory stays bounded and numbers stay fresh.
  • One process per machine — the receiving side runs the diode tool for you.
  • Damage is contained — a diode cannot retransmit, so a corrupted value is dropped and the stream resynchronises rather than losing everything queued behind it.
  • Zero dependencies — a single static binary, Go standard library only.

How it fits together

  internet side                     diode                  protected side
  ─────────────                     ─────                  ──────────────
  ANU ──> collect ──> [ stream-send ] ══════> [ stream-recv ] ──> serve ──> GET /api/random
                            stdin                  stdout          │
                                                                   v
                                                            in-memory pool

The collector never learns whether anything arrived — nothing comes back. Nothing is stored either: a transfer the diode will not take is retried and then discarded, and the pool is lost on restart, refilling from the far side's next cycle.

Getting started

See Usage. It is two commands per machine.

Requirements

  • A tool that can stream data across your diode, on both sides.
  • An ANU API key from quantumnumbers.anu.edu.au, free with an account. Optional if you only use the legacy endpoint.

Licence

Released under the Unlicense — public domain.