Would it be secure to use random numbers from random.org in a cryptographic solution?

Question

Random.org provides true random numbers through an unsecured web service. Since these numbers would be transmitted in plaintext could they still be considered useful as true random numbers while maintaining security in a cryptographic solution?

At first I was thinking if a large pool of them was obtained then a small subset of them could be used randomly to make the fact they are known of less use. Then I realized that no matter how many random numbers were obtained this way, it would still be a smaller number set to explore in attempting to crack the cryptography.

Update: Random.org supports SSL over HTTPS, but are not encouraged for use in cryptography.

Answer 1

The more I think about it, the less I would be willing to use Random.org for any sort of cryptographic application. My reasons are listed below.

1. See Q2.2, the groups listed are not cryptographic groups and potentially (or probably) don't have cryptographers on their evaluation teams
2. They specifically say not to use it for cryptography
3. It is closed source. So, I would have no way of knowing if they properly mutex their RNG so that only one person is drawing from it at a time. There are other implementation issues that I (or someone/some group much smarter than I could check for).
4. Using this would require an internet connection for all randomness.
5. Current CS-PRNGs are much faster and options are available which suffer from none of the weaknesses listed above.
6. The RNG could change at any time without me knowing.

That said, these reasons don't necessarily answer the question. They only give insight as to why I personally wouldn't use Random.org for cryptography. Would it be secure to use Random.org in cryptographic solution? Possibly. There really isn't enough information to really know.

Answer 2

It is so easy to create cryptographically-strong random numbers in ways that are known to be strong that adding new methods that add new risks is not advisable. However, if you have an existing method that is known to be secure and has the ability to take in additional sources of randomness in way that cannot do harm even if they are known to an attacker, than go ahead and add them. You have nothing to lose.

Answer 3

In cryptography, randomness is mostly about being unknown to any attacker. Any attacker could observe your download of these random numbers, and now they are not really random since the attacker knows them too.

There is an article from Crypto'97 which describes something which looks like that: it is a secure key exchange system which defeats memory-bounded adversaries. This assume a shared source of randomness which broadcasts random numbers; anybody can listen to it, including any attacker. Two parties who wish to get a shared key record just a few chunks out of the random bits, noting the position of each chunk in the stream (say, the exact emission time). At the end of the day, they send to each other the list of positions; if they recorded enough, there is high probability that there are a few chunks they they both recorded, and they can use these as a shared key. On the other hand, an attacker willing to learn that key would have to record quite a lot of the stream in order to have a fair chance of having all the chunks that the two parties have in common.

This key exchange mechanism is safe as long as the random source broadcasts data at a very high rate, so that recording all of a day's broadcast is not doable. So it should be in gigabytes per second or so.

In a way, using the numbers from random.org is like using this model: you record insecure random numbers, and at the end of the day you assume that you could get some that the attacker failed to record himself. To get a key out of your pool, you could for instance hash the whole of it with a secure hash function such as SHA-256 (don't pick numbers out of the pool; instead, use a hash function, which will not "forget" any entropy). Still, in practice, this fails on several accounts:

• The Web in general, and your Internet access in particular, is nowhere near fast enough for this. An attacker can easily record terabytes of data, so you should download much more than that. Your ISP will not be pleased (unless your contract includes a quota, and gigabytes beyond the quota are billed, in which case the ISP will be thrilled).

• random.org itself could be an attacker, and feed you what are claimed to be "true random numbers", but are actually the output of a pseudo-random number generator. You would not be able to see the difference. But this would allow the attacker to rebuild the random numbers you got (all of them) at will.

• An active attacker could alter the numbers you get, in effect reducing the problem to the previous point.

So, to make the story short: no, random.org is not useful to security or cryptography.

Answer 4

Since you cannot be assured that random.org is not retaining a copy of the number, nor is its transport to you necessarily confidential, you should think of numbers from random.org as public randomness. That is perhaps pessimistic but it will lead you to use such numbers in the correct manner.

Obviously, public randomness is not useful for generating secrets in cryptography.

However there are a number of scenarios where public randomness is perfectly ok. Here are a few:

1. Generating challenges for random audits
2. Generating challenges for interactive proofs
3. Fair exchange
4. Generating an auxiliary random string for reference
5. Choosing non-secret "keys" for things like extractors or instances of a hash function from a family of hashes
6. Choosing initialization vectors or salts

A source of public randomness is sometimes called a "beacon." It is an important enough service that NIST is in the progress of creating one. Their whitepaper explains some of its uses and mentions random.org. Another option is to use financial data, which we showed to have sufficient entropy.

Answer 5

It would be secure only

• If you trust the connection to random.org (and as you said, it is unsecured)
• If you trust random.org itself (it could e.g. log the generated data along with your IP)

So I'd say it is not secure, in general.

Answer 6

You could always build your own generator. Pretty cool.

Answer 7

The short answer is: the online random number generators (or better, online radioactive/quantum sources) have high entropy and are unpredictable, but they lack the element of guaranteed privacy needed to be used verbatim as a secret key.

Notice that privacy of thought is assumed in the usual Alice and Bob crypto theory stories; mind reading each other or the narrator is not allowed.

Answer 8

Any serious person should not trust random.org to be up all the time. It's maintained by a non-commercial entity that has no economic value in staying up all the time. So your server would only get random numbers as long as it is available. That should be enough to stop any serious usage (beyond the security reasons mentioned by all the others).

I could see a scenario where you have a weak entropy pool, and you use random.org to add additional entropy to your own pseudo random number generator. If it is down, you may fall back to your own weak entropy sources. Note that you need to seriously test if your fall back scenarios work though, you should not get stuck once random.org is suddenly not sending any data anymore.