What's the best approach to make PRNGs favourably deterministic a.k.a. biased and how to protect yourself against this?

Question

First of all, I'm not an expert or even a novice in Cryptography.

I mean this has certainly been implemented by some scummy PRNG developers, which thought of the economics behind it (especially in the casino and similar businesses where the biased distributions would interest people to play from the start but in the long run made profits for the casinos etc). So it might be even legal in some cases, but this not Law StackExchange ;-)

Yes, I am aware that PRNG have a period and hence are practically deterministic already, just that the period is big enough for most use cases.

My questions would be:

• How do you make a certain PRNG (in two scenarios - black box and the opposite of it) favour certain amount of values? For example, in a casino game how do you make randomness biased for your own benefit?
• And most important, how do you test that your or someone else's PRNG is not biased like this? What if you in theory made such a system that only starts showing it's true intentions after too computationally heavy amount of computations?
• Has there been any real world case studies of this?
• Does this apply for my theoretical use case protecting against bias?

Answer 1

This is very generic set of questions, so I'll answer the questions generically as well:

How do you make a certain PRNG (in two scenarios - black box and the opposite of it) favour certain amount of values? For example, in a casino game how do you make randomness biased for your own benefit?

This is not a very good approach at all. You don't want to make the random number generator favor certain values, as that would be easy to detect. Instead you want to make the values predictable.

The way to do this is to make the result dependent on some kind of secret. For a black box scenario the problem is very easy to solve: you use a stream cipher, which is supposed to create a fully randomized key stream.

For a white box the trick is to create the random number generator in such a way that the cryptographic community doesn't detect any wrongdoing. This was e.g. tried by the NSA when they pressurized NIST and RSA labs to adopt the Dual-EC based random number generator.

And most important, how do you test that your or someone else's PRNG is not biased like this?

You use test tools such as Die Hard(er) to test if the random values are well distributed. Small changes are hard to detect though, but probably also hard to use.

What if you in theory made such a system that only starts showing it's true intentions after too computationally heavy amount of computations?

That would probably easy to detect if you have access to the algorithm, and hard to use. I don't know why you would go that direction if you can create a fully predictable PRNG.

Has there been any real world case studies of this?

Have you looked?

Does this apply for my theoretical use case protecting against bias?

Whitening can protect against bias, but it won't help you if the random source itself can be predicted; whitening techniques themselves are deterministic after all.

Maybe in your situation XOR'ing with a key stream would help. The result would retain the randomness, but it would also depend on the key stream.