A cryptographically secure pseudorandom number generator is a pseudo-random number generator with properties that make it suitable for use in cryptography.

learn more… | top users | synonyms

13
votes
1answer
3k views

What stops the Multiply-With-Carry RNG from being a Cryptographically Secure PRNG?

Despite the fact that Marsaglia's MWC PRNG (multiply-with-carry random number generator) is considered to be "the mother of all RNGs", it does not seem to be considered to be a CSPRNG ...
10
votes
5answers
7k views

What is the difference between CSPRNG and PRNG?

What is the difference between CSPRNG and PRNG? Is there performance differential between them? For example: We use PRNG for key generation which is very expensive and CSPRNG for IV/nonce in block ...
10
votes
1answer
490 views

Shared secret: Generating Random Permutation

-- or: How to Play Poker Without a Dealer I know this question is long but it's a really interesting theoretical problem about shared secrets and multi-party computation. General Problem: "Shared ...
9
votes
3answers
3k views

Is a die implemented in a physics engine truly random?

So, a fair die throw is really random, not pseudo. So, would a RNG implemented as the result of a die throw in a physics engine (say, Newton, Havok, Nvidia's PhysX) be regarded as both ...
8
votes
3answers
498 views

Why do we require a CSPRNG's output to be indistinguishable from true random?

Everywhere I read, indistinguishability of output from true random is stated as a requirement for CSPRNGs. However nobody bothered to give the rationale for such a strong requirement. Specifically, ...
8
votes
1answer
1k views

Can a LFSR be cryptographically secure?

I have been looking at an embedded microcontroller which has a cryptographic hardware engine (in particular the PIC32MZ family). These devices have what they advertise as a cryptographically secure ...
7
votes
5answers
928 views

How to prove the security of the PRNG?

Are there any realties tests or criterias that prove the security of the PRNG? What kind of tests or criteria?
7
votes
3answers
558 views

Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?

I am actually looking for available crypto libraries including a deterministic random generator for the purpose of a dedicated crypto key generator unit. I have a simple question about the X9.31 based ...
6
votes
1answer
971 views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
6
votes
1answer
224 views

Why does anyone use elliptic curves for a CSPRNG?

I saw Martijn Grooten's talk on elliptic curves at BSides London this year, and it helped me understand how elliptic curve crypto works, especially in the case of Diffie-Hellman (ECDH). He also ...
6
votes
1answer
80 views

Are CSPRNGs quantum-resistant?

It's fairly well known that Shor's algorithm kills RSA, DSA, ECDSA, DH, ... and that symmetric ciphers (AES and 3DES) and hashes (SHA-2, SHA-3) are safe as long as you double your key size / output ...
5
votes
2answers
520 views

Definition of a CSPRNG

I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ...
5
votes
1answer
191 views

Is it possible to determine or estimate the period for Blum-Micali PRG?

The Blum-Micali is a cryptographically secure pseudorandom number generator. The construction (from wikipedia): Let $p$ be an odd prime, and let $g$ be a primitive root modulo $p$. Let $x_0$ be a ...
4
votes
2answers
171 views

How should I generate secure random numbers deterministically?

I have a 256-bit seed; call it P. From P, I need to derive 219 256-bit numbers deterministically. There's a catch, however: I want to derive them in any order. For example, I might need the 7878th ...
4
votes
2answers
529 views

Using SHA3 as an entropy pool

Has any work been done on analyzing the SHA3 sponge construction for use as an entropy pool (e.g. /dev/random)? All the use cases I've heard of consts of a ...
4
votes
1answer
427 views

How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?

Wikipedia claims: A secure block cipher can be converted into a CSPRNG by running it in counter mode. This is done by choosing a random key and encrypting a 0, then encrypting a 1, then encrypting ...
4
votes
2answers
97 views

A periodic PRNG based on hash function?

I need a PRNG which provides 128 bytes numbers. Let's say that given a symmetric key $K$ and an internal state $s$ I use the PRF HMAC-SHA512 this way: The output is PRNG($K, s$) = ...
4
votes
1answer
124 views

Cryptographic pseudo-random generation of address subsets

Suppose I have devices which broadcast, on an insecure channel, 32-bit addresses. I want to make these devices untraceable - one way to do so is to allocate for each device a distinct subset of ...
4
votes
1answer
1k views

Are there any Javascript CSPRNGs? [closed]

I'm writing some software that requires the use of a CSPRNG with javascript for use in the browser and I'm wondering what libraries are available. Crypto-js doesn't seem to have a CSPRNG I can ...
4
votes
0answers
70 views

What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistal ...
3
votes
2answers
156 views

CSPRNG that cannot be used as random extractor

Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any ...
3
votes
1answer
301 views

Practical (and secure) PRGs

Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, ...
3
votes
1answer
131 views

CTR DRBG dependent on request size?

I am trying to understand the CTR DRBG specification in NIST SP 800-90A. It seems slightly different to a pure stream cipher in that the key and counter are reset after each generate call using the ...
3
votes
2answers
312 views

Do I need an IV to use AES-CTR as a CSPRNG?

I'm using AES128-CTR for generating pseudo-random values, which is considered secure for up to 1MB (at least from what I've read). I simply encrypt a 128-bit little-endian counter, starting from 0. ...
3
votes
1answer
226 views

Using Stream Cipher as CSPRNG

Are there any guidelines or justification for converting a stream cipher algorithm for use as a CSPRNG? For instance, lets say I wanted to convert one of the eStream portfolio Profile 1 (software) ...
3
votes
1answer
2k views

Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
3
votes
1answer
177 views

Detecting steganography in the stream of short messages

I have stream of millions of short n-bit (n<30) messages generated by some random number generator. The source of random number generator is not available to me. I suspect there are messages used ...
3
votes
1answer
44 views

Using AES-CTR to generate AES subkeys from a master key and nonce

Suppose I would like to encrypt some data using AES-GCM because it has hardware support on my processor and it is secure. Unfortunately, I don't like the 96-bit nonce size, because I want to randomly ...
3
votes
2answers
322 views

Algorithm for generating OAuth tokens

I'm trying to find a good algorithm for generating authorization codes, access tokens and refresh tokens in an API. Currently, I am looking into the following setup: Tokens are generated using the ...
3
votes
1answer
525 views

How can I prove/disprove that a construction yields a secure PRG?

Let $G:\{0,1\}^{*} \mapsto \{0,1\}^{*}$ be a secure PRG. Prove or disprove that the following construction also yields a secure PRG. $$G'(k) = G(k||0),$$ where $||$ denotes the concatenation of two ...
2
votes
1answer
99 views

Stream Ciphers and cycling questions

For all PRNGs (including CSPRNGs) lets say there is a sequence x, y, z, then when the PRNG cycles back to x, then the sequence following it will be exactly the same as before. Is this true for all ...
2
votes
3answers
258 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
2
votes
1answer
156 views

Can I make a PRNG that is secure even when state can be modified by user?

I am interested in making a PRNG which, after being initially seeded, can accept and incorporate client data as the only ongoing source of "entropy". It is not directly for a cryptographic purpose, ...
2
votes
1answer
59 views

Has there been any research on entropy efficient information-theoretically secure PRNGs?

I have an idea for an research project, but I am first wondering if it has been researched or implemented before. I think I have a way to come up with a set of PRNG algorithms which have the ...
2
votes
1answer
194 views

Why in Android kernel CSPRNG state is saved?

I am reading about the security internals of Android. In the book Android Security Internals, in chapter on Cryptographic Providers, there is a para stating: On Android, CSPRNG implementations are ...
2
votes
1answer
140 views

Noisiest RF band for random number generation

I've been looking into the difference between PRNGs and proper RNG techniques. One that I particularly like is the idea of tuning a radio to a certain frequency and bandwidth and just listening to the ...
2
votes
1answer
81 views

Collision likelihood from /dev/urandom for VMs using the same underlying hardware

We have multiple virtual machines sharing the same physical hardware. We use /dev/urandom for session key generation. But a question comes up: if ...
2
votes
0answers
117 views

How to break this PRNG encryption scheme? [closed]

Suppose we have the following symmetric algorithm: key = random bits G = PRNG(seed: key) input = [0,1,1,0,1,0,0,0, 0,1,1,0,1,0,0,1] // "hi" in ascii The key can ...
2
votes
0answers
249 views

Difference between statistical PRNG and cryptographic PRNG? [duplicate]

What's the difference between a statistical pseudorandom number generator (PRNG) and a cryptographic-strength PRNG? I've seen a lot of PRNGs that are proposed for statistical uses -- e.g., ...
1
vote
4answers
3k views

Is a Mersenne-twister cryptographically secure if I truncate the output?

I want to create an online roulette game. Is it OK if the PRNG is seeded only once, when the user starts the game, or is it recommended to re-seed sometimes during game? Maybe just seeded once a day ...
1
vote
3answers
433 views

Extracting only the entropy

(I cleaned up the question a bit, It was previously titled "extracting entropy without hashing" .. thus some of the comments / answers) I'd like to extract the entropy of data without injecting ...
1
vote
3answers
1k views

Estimating random number entropy for input into 256 bit hash

Assuming a random number generation process outputs lots of numbers between 0-9. First I gathered up a bunch of the numbers, converted them to binary and created a bitmap. Not so random as you can ...
1
vote
2answers
240 views

Availability of a simple limited PRNG algorithm

I am in need of a really simple limited PRNG, that either exists or can easily be created in virtually any language on any platform. It takes only the initial seed, and is only expected to generate a ...
1
vote
1answer
59 views

HMAC_DRBG Generate Process: requesting N bytes at once different from requesting N bytes in total?

Am I correct in assuming that HMAC_DRBG would return different results if I, e.g. first request 4 bytes followed by a request of another 4 bytes instead of asking for 8 bytes at once? It seems that ...
1
vote
1answer
399 views

Security of SecRandomCopyBytes on OSX and iOS

How secure is SecRandomCopyBytes() (Apple's RNG)? Has anyone ever reviewed it?
1
vote
1answer
28 views

Metrics of PRNGs

I am a bit confused on the metrics that can be applied to the output of (deterministic) pseudo-random number generators. I've run output from many RNGs through ENT. The only metrics that really differ ...
1
vote
2answers
82 views

Fortuna: why are source ID and data length added together with entropy data into the pools

Section 9.5.6 of Cryptography Engineering states that The concatenation [of source number, length of data, and data itself] is then appended to the pool. Why are we including source number and ...
1
vote
1answer
182 views

CTR_DRBG versus OFB_DRBG

As far as I know, in the development of ANSI X9.82, there was consideration of OFB_DRBG, a pseudorandom number generator based on block ciphers like CTR_DRBG, but it appears to have been rejected of ...
1
vote
1answer
279 views

Why does Fortuna RNG use double SHA-256?

In the paper for Fortuna the authors say that you can use any good digest algorithm (obviously as long as its output is 256 bit) and then they recommend double SHA-256. Why? What's the benefit? What ...
1
vote
0answers
56 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...