Tag Info

New answers tagged

3

PRNGs are a difficult and hot topic. Some tests can be found here: What tests can I do to ensure my PRNG is working correctly? But they do not tell you (or others) if your PRNG is really secure. A PRNG must be build in a way, that a third party is not able to "calculate" former or upcoming PRNG output based on some random data from the PRNG.


1

Your idea for constructing a distinguisher from a predictor is fine, assuming you know that the predictor predicts the last bit. The more general statement is: if you can predict any bit of the output, say the $i$th bit, given the first $i-1$ bits, then you can also build a distinguisher. A similar idea to what you showed also works to prove this ...


0

In these times of ecological awareness, I'll sketch a pain and paper ™ solution which does not require brute force nor power supply :-D On top of that, the complexity of this solution is linear in the seed size, not exponential as that of brute force solutions. Let me denote by $[v]_i$ the $i$-th lower bit of $v$ and the internal state at iteration ...


3

All Bouncy Castle's random generator classes seem to derive from java.security.SecureRandom, where seed doesn't mean "initialize state to this". It means "stir in any entropy from this". That means what they do is not insecure, but shouldn't actually help either, since java.security.SecureRandom is already seeded with entropy from the system (e.g. ...


15

Yes, it is unsafe to seed a PRNG with only with the system time. No, that's not all Bouncy Castle's SecureRandom does. The SecureRandom default constructor calls SetSeed(GetSeed(8)); which calls Master.GenerateSeed(length); which calls SetSeed(DateTime.Now.Ticks); which is misleading because SetSeed only adds seed material to an already existing prng (the ...


0

As Steth stated before, using system time as seed in cryptographic implementations is terrible idea for any PRNG because this may be simply very predictable. There are better solutions based on noise generated by device drivers in the system (see man urandom) What you want from PRNG in cryptography is to be uniform and unpredictable, so the entropy would be ...


0

Assuming the random source is a Bernoulli process such that the von Neumann corrector can make it perfectly random, the bits are, by definition, uncorrelated with anything else, including your timestamps. In the real world that assumption may not hold, but in that case your existing von Neumann corrected random stream is also faulty. That said, the ...


3

The values of these timestamps appear to be determined by two components: when your code decides to sample the GPIO inputs; and whether a bit is to be discarded or not. The first component is not proven to be random (and if you assume it is, you would not need to add complexity to this RNG; just create a second RNG based on CPU execution jitter). The ...


2

You can slow the faster stream down to match the slower (e.g. throw away about half the bytes) and use Knuth's algorithm. You will only run at the speed of the slower, but that's the only way to assure full entropy when only one of the streams is unpredictable. If you want to also account for cases where both streams are only partially unpredictable, you ...


3

What tests can I do to ensure my PRNG is working correctly? That depends on what exactly you mean by “working correctly”. You can do statistical tests to check for various statistical flaws your random number generator might be subject to, but you have be aware of the fact that statistical testing cannot serve as a substitute for cryptanalysis… ...


1

How to prove the security of the PRNG? My best advice would be to start with a statistical test suite like the one NIST describes in "A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications" (PDF). It’s a battery of statistical tests to detect non-randomness in binary sequences constructed using random ...


6

First, the obvious advice is not to use this in practice. Rolling your own is fine for learning, but you should use standard primitives when you need actual security. E.g. one from SP 800-90A which poncho linked in comments. Now, some observations. I haven't read all your code, so I may misunderstand things. Is this a good way to whiten the data? Is ...


3

How does Web Cryptography API (eg window.crypto.getRandomValues) produce secure PRNG? Like the specification says: Implementations should generate cryptographically random values using well-established cryptographic pseudo-random number generators seeded with high-quality entropy, such as from an operating-system entropy source (e.g., ...


5

There are many ways to combine random number generators: XOR the outputs. Very simple and fast. If they are independent and at least one is strong, the output is strong as well. However, if those assumptions are not true, this can be very broken. Hash the outputs. With a strong hash you combine the entropy of both. Good if the RNGs have some entropy, but ...


2

Berlekamp-Massey is designed for the situation where you have observed $2n$ consecutive output bits from a $n$-bit LFSR. It doesn't work if the observed bits are scattered randomly, at random non-contiguous offsets in the stream. Information-theoretically, a minimum of $2n$ bits of output are needed to reconstruct the LFSR. Intuitively, this is because ...


7

The problem with questions that ask for “the fastest” is, that such questions always raise the counter-question: compared to what exactly? Also, your question doesn’t specify if you mean cryptographically secure physical random number generators, or any physical random number generator. Anyway… 400 Mbps doesn’t really come anywhere near the word “fastest”. ...



Top 50 recent answers are included