wj-diode-quantum

Collects quantum random numbers from the Australian National University, streams them across a data diode, and serves them one at a time on the protected side. Each value is 1024 bits.

A data diode only carries data one way. That makes it excellent at keeping a network isolated and useless for anything that needs a reply — so a machine behind one cannot simply ask ANU for random numbers. This program splits the job in two: one side collects and pushes, the other side stockpiles what arrives and hands it out on request.

Features

• The numbers are never written in the clear — the collecting side writes nothing at all, and the serving side keeps its pool encrypted or not at all, under a passphrase held in the environment rather than beside the file.
• Both ANU APIs — the current keyed service and the older unkeyed one, each polled on its own schedule sized to its rate limit. Enable either or both.
• Any diode tool — moving data across the diode is a configured external command reading and writing a stream. diodetool is what this was built against, but nothing about it is hard-coded.
• Never serves the same number twice — including across a restart when the pool is persisted. A value is recorded as served on disk before it reaches the client, so a crash mid-request can only lose it, never hand it out twice.
• Four output formats — JSON, hex, base64, or raw bytes, with the metadata in response headers. An OpenAPI description is served alongside them.
• Bounded, self-trimming pool — newest served first, oldest discarded at capacity, so memory stays bounded and numbers stay fresh.
• One process per machine — the receiving side runs the diode tool for you.
• Damage is contained — a diode cannot retransmit, so a corrupted value is dropped and the stream resynchronises rather than losing everything queued behind it.
• Zero dependencies — a single static binary, Go standard library only.

How it fits together

  internet side                     diode                  protected side
  ─────────────                     ─────                  ──────────────
  ANU ──> collect ──> [ stream-send ] ══════> [ stream-recv ] ──> serve ──> GET /api/random
                            stdin                  stdout          │
                                                                   v
                                                          pool (encrypted on
                                                           disk, or memory)

The collector never learns whether anything arrived — nothing comes back. On the sending side nothing is stored at all: a transfer the diode will not take is retried and then discarded. On the serving side the pool can be kept across restarts, encrypted; without that it is lost on restart and refills from the far side's next cycle.

Getting started

See Usage. It is two commands per machine.

Requirements

• A tool that can stream data across your diode, on both sides.
• An ANU API key from quantumnumbers.anu.edu.au, free with an account. Optional if you only use the legacy endpoint.

Licence

Released under the Unlicense — public domain.