What research suggests that user's mouse movements are (not) sufficiently unpredictable for secret key generation?

Question

I have not been able to find any credible source which tried to prove or disprove the randomness of mouse movements.

• A Google Scholar search for "mouse movement entropy" gives surprisingly few results: about one page of computer science results, of which three which are tangentially related, before it gets to research on "behaviour of mice in open fields" (which was enthralling, by the way).
  1. "User re-authentication via mouse movements" is related but tangential. While they seem to get pretty good results in terms of false positives and false negatives, they note that it's not good enough for authentication by itself. This indicates that, at least when you have one mouse movement sample of an individual, it should be much easier to predict future movements (and nobody ever visits an untrusted website which could capture your mouse movements).
  2. "A true random number generator based on mouse movement and chaotic cryptography" is a proposal on how one could implement such an RNG, not whether the source (mouse movements) are actually unpredictable in the first place.
  3. And a git repository for the aforementioned proposal.
• Relevant questions on this website do not answer the question: none are either long enough to contain evidence in itself (which would have to be empirical, since we're talking about analysing human behaviour, so that means describing a test setup, giving statistical properties of the results, describing the conclusion... a big post altogether) or link to such research.
  • What are you doing when you move your mouse randomly during a truecrypt volume creation?
  • Research about entropy of human randomness?
    • Note that this question is not a duplicate because I am asking about mouse movements specifically. That question is more broad, as exemplified by the answer regarding user-chosen passwords or user-generated brain waves.
  • How much more secure is encryption if the program requires random input from the user?
  • Is this password generator safe?
  • How much time / "entropy collected" should generating a RSA 2048bit keypair take?
  • How high is the entropy of this salt-generating code? (No code-reading actually necessary)
  • Approximately how much entropy in each of these low entropy sources?
  • For how much time should I randomly move the mouse for generating encryption keys?
• On our sister site, there are again relevant questions but no answers which answer this question:
  • https://crypto.stackexchange.com/questions/3347/are-mouse-movement-coordinates-useful-as-a-seed-for-a-rng
  • https://crypto.stackexchange.com/questions/39833/does-iterative-hashing-of-mouse-keyboard-input-improve-its-properties-as-an-entr
  • https://crypto.stackexchange.com/questions/1618/feedback-on-rolling-my-own-entropy-gatherer
  • https://crypto.stackexchange.com/questions/25847/hkdf-entropy-extraction
  • https://crypto.stackexchange.com/questions/14632/standard-or-guidance-for-entropy-collection
  • https://crypto.stackexchange.com/questions/14632/standard-or-guidance-for-entropy-collection
  • Mentions that NIST defines some statistical tests which you can do, presuming it will show that mouse movements pass such tests. I am not sure how comprehensive this battery of tests really is since in my experience, most such tests pass anything and everything with flying colours. It might be good to know if those tests are reliable and if so, if they indeed approve of mouse movements.
• Random web results:
  • https://en.wikipedia.org/wiki/Entropy_(computing) None of the sources seem to answer the question. (The article does not claim mouse movements have good entropy.)
  • https://www.reddit.com/r/crypto/comments/937qzb/my_findings_on_extracting_entropy_from_mouse/
    • The conclusion is more about how compressible mouse movements are, than about the actual unpredictability. As a short example, while a compressor would usually not be able to compress the output of a simple RNG by much, observing even a few outputs might be enough to predict the next state. Similarly, if a few points describe the curve the mouse is making, one can extrapolate many of the other points. I'm not saying the source is irrelevant, but I also don't see it as (close to) conclusive evidence.
    • Reading the comment thread after writing the above, I found it funny to see someone saying "Estimating [unpredictability of] user mouse movement is a complicated human factors question.. there is probably some academic research on that already". You don't say!

It might be relevant to mention that a quick look at the Puttygen source code indicates that it seems to generates private keys solely based on mouse movements. It fills an array with the time of mouse movement events in the even cells and the mouse position in the odd cells, sprinkles some magic shuffling over it (shuffling memory, xoring fields), and calls some RSA/DSA/EC* key generator with the array as argument. Whether there is serious evidence that mouse movement is a good entropy source is quite important for such use-cases. Note that this is different from using it as an additional source, such as in the Linux kernel, which will only increase the quality even if it's a mediocre source.

I have a hard time believing nobody ever looked into this. What am I missing?

Answer 1

I do not believe there are any research papers that describe the unpredictability of the neuromuscular system in the context of computer security and at the sample rates that are relevant, so I can't link the research papers you want. However, I can explain at least a few of the reasons why human movement is so stochastic and unpredictable. It all boils down to a simple fact: Living tissue is a really, really sloppy medium for information transmission. This has been known for a very long time and has constantly been a thorn in the side of computational neuroscientists and anyone trying to make mathematical models of neuron groups. Biological neural networks are terrible computers.

The transmission speed of neurons varies, sometimes significantly. Even within a single neuron, the speed is variable. In addition, the number of action potentials (electrical signals that propagate down the axon) sent in succession is dependent on the probability that microscopic ion channels will open at any given time. Additionally, muscles have a high amount of jitter. The force from a muscle does not come from a gradual increase in activity, but from discrete bunches of muscle cells, called motor units, being activated. Even if we flex as hard as we can, we never activate 100% of the muscle's motor units (if we did, it could cause physical damage to the tendon). This random motor unit recruitment leads to the twitchy vibration typical of voluntary skeletal muscles.

The combination of the extremely stochastic behavior of neurons and the probabilistic activation of muscle cells leads to minute variable delays in timing. While these delays are imperceptible to a human, a computer ticking away at billions of times per second (yeah, I know this is actually limited by the speed of the keyboard microcontroller, among other things) quickly notices this. Millions of cycles can pass by due to the random delays intrinsic to neural transmission, and these random delays can be measured and used as a source of entropy. While we do not have any research showing exactly how many bits of entropy each action potential will generate, we can make an extremely conservative guess and say that the entire process, from brain to muscle to keystroke, leaves us with around a single bit of entropy. All it takes then is a few hundred keystrokes to obtain a cryptographically significant amount of entropy.

The stochastic behavior of the human brain is described quite well here (see sections 3 and 4).

---

Entropy from keystrokes or mouse movements thus comes from two sources:

1. Individual variations in people due to a unique number neurons and unique neural circuits.

2. Time-dependent variations in action potential transmission speed, motor unit recruitment, etc.

All of this results in random delays that, while irrelevant to everyday tasks, is quite visible to a computer with sometimes even sub-nanosecond temporal resolution. If we sample the time of events (not just data like mouse pointer position or key being pressed), we can safely say that it contains at least a nominal amount of entropy. After all, given all this stochastic randomness, it should become obvious that it is impossible to guess, within nanoseconds, how long it will take a signal originating in our brain to trigger a muscle to contract to depress a key.

However, it's important to know that it's easy to get entropy collection wrong. You can't just sample mouse movement and use system time as a clock. You need to trigger the sampling immediately when the event occurs. This means collection must occur within the kernel, typically within an interrupt handler that is executed instantly when an interrupt occurs. Otherwise, it's very possible that predictable scheduling delays will taint the collected entropy. After all, what's the good of a random keypress event if it's buffered as soon as it occurs and is only released to userspace in predictable intervals? You should always leave entropy collection to the OS itself.

Answer 2

IMHO, the concept is borrow from mouse movement user fingerprinting, in which, the scale of complexity is totally different when apply for key generation.

If you start comparing both, you will notice, user identification using mouse movement fingerprinting required less entropy to improve identification, high false positive is acceptable. Thus, them mouse movement fingerprinting will yield a high accuracy.

On the other hand, mouse movement key generator is using high entropy subject to the person mood and environment, which I doubt anyone can reproduce in any control environment. E.g. a person in empty stomach will move the mouse differently compare to a full stomach.