# Tag Info

1

Most PRNGs accept a constant width seed. That means they could only be used as randomness extractors for that input size; no less, no more. For example, AES-128 CTR CSPRNG (from 800-90A) would only accept 256 bits of seed for the key and initial vector in total. Further, if the input is not fully random (as you'd expect with a randomness extractor), they ...

0

I would say that whitening is a more general concept than randomness extraction. In randomness extraction you have an input with some entropy that isn't perfectly random and an output that should be perfectly random and full entropy. In whitening there is not necessarily an entropy requirement on the output, it just needs to look perfectly random to an ...

4

There is some relationship between the two notions, but a CSPRNG is designed to be computationally secure (secure against adversaries with bounded computation time), whereas a randomness extractor is required to be information-theoretically secure (unconditionally secure against adversaries with unbounded computation time). So, they're different primitives. ...

2

On your earlier questions: 1) How secure is this method for generating one-time pads in block- or stream-ciphers? This method in itself is not secure, as the output weakly random entropy source, not a TRNG; there is entropy in the keystrokes, but without any whitening and extraction taking place, the output is - for instance - not well distributed. The ...

3

PRNGs are a difficult and hot topic. Some tests can be found here: What tests can I do to ensure my PRNG is working correctly? But they do not tell you (or others) if your PRNG is really secure. A PRNG must be build in a way, that a third party is not able to "calculate" former or upcoming PRNG output based on some random data from the PRNG.

2

Your idea for constructing a distinguisher from a predictor is fine, assuming you know that the predictor predicts the last bit. The more general statement is: if you can predict any bit of the output, say the $i$th bit, given the first $i-1$ bits, then you can also build a distinguisher. A similar idea to what you showed also works to prove this ...

0

In these times of ecological awareness, I'll sketch a pain and paper ™ solution which does not require brute force nor power supply :-D On top of that, the complexity of this solution is linear in the seed size, not exponential as that of brute force solutions. Let me denote by $[v]_i$ the $i$-th lower bit of $v$ and the internal state at iteration ...

3

All Bouncy Castle's random generator classes seem to derive from java.security.SecureRandom, where seed doesn't mean "initialize state to this". It means "stir in any entropy from this". That means what they do is not insecure, but shouldn't actually help either, since java.security.SecureRandom is already seeded with entropy from the system (e.g. ...

15

Yes, it is unsafe to seed a PRNG with only with the system time. No, that's not all Bouncy Castle's SecureRandom does. The SecureRandom default constructor calls SetSeed(GetSeed(8)); which calls Master.GenerateSeed(length); which calls SetSeed(DateTime.Now.Ticks); which is misleading because SetSeed only adds seed material to an already existing prng (the ...

0

As Steth stated before, using system time as seed in cryptographic implementations is terrible idea for any PRNG because this may be simply very predictable. There are better solutions based on noise generated by device drivers in the system (see man urandom) What you want from PRNG in cryptography is to be uniform and unpredictable, so the entropy would be ...

0

Assuming the random source is a Bernoulli process such that the von Neumann corrector can make it perfectly random, the bits are, by definition, uncorrelated with anything else, including your timestamps. In the real world that assumption may not hold, but in that case your existing von Neumann corrected random stream is also faulty. That said, the ...

3

The values of these timestamps appear to be determined by two components: when your code decides to sample the GPIO inputs; and whether a bit is to be discarded or not. The first component is not proven to be random (and if you assume it is, you would not need to add complexity to this RNG; just create a second RNG based on CPU execution jitter). The ...

2

You can slow the faster stream down to match the slower (e.g. throw away about half the bytes) and use Knuth's algorithm. You will only run at the speed of the slower, but that's the only way to assure full entropy when only one of the streams is unpredictable. If you want to also account for cases where both streams are only partially unpredictable, you ...

3

What tests can I do to ensure my PRNG is working correctly? That depends on what exactly you mean by “working correctly”. You can do statistical tests to check for various statistical flaws your random number generator might be subject to, but you have be aware of the fact that statistical testing cannot serve as a substitute for cryptanalysis… ...

1

How to prove the security of the PRNG? My best advice would be to start with a statistical test suite like the one NIST describes in "A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications" (PDF). It’s a battery of statistical tests to detect non-randomness in binary sequences constructed using random ...

6

First, the obvious advice is not to use this in practice. Rolling your own is fine for learning, but you should use standard primitives when you need actual security. E.g. one from SP 800-90A which poncho linked in comments. Now, some observations. I haven't read all your code, so I may misunderstand things. Is this a good way to whiten the data? Is ...

3

How does Web Cryptography API (eg window.crypto.getRandomValues) produce secure PRNG? Like the specification says: Implementations should generate cryptographically random values using well-established cryptographic pseudo-random number generators seeded with high-quality entropy, such as from an operating-system entropy source (e.g., ...

Top 50 recent answers are included