-1
$\begingroup$

Given a range of numbers, e.g. [1, 2^256], does each number have the same chances to be picked by a CSPRNG, which are 1 in 2^256?

My concern is that truly random number generators do have this feature, but it's not always secure in cryptography (I presume), because numbers such as 741 in such a large range that is [1, 2^256] are not secure.

If that's true, do CSPRNG skip certain sub-ranges? Like, in our example [1, 2^32], because they're considered insecure? If that's also true, isn't this like beating the air, because now the attacker will know to skip these sub-ranges?

Improve this question
$\endgroup$
10
  • 3
    $\begingroup$ Why would a random 256 bit value that happens to be 741 not be secure, compared to (say) 4787985879261692769246529503049509767911957330519830813409881797811302? If the adversary is guessing randomly, the latter is just as probable as the former... $\endgroup$
    – poncho
    Nov 19, 2022 at 21:01
  • $\begingroup$ @poncho, but not as secure. $\endgroup$
    – Angelo M.
    Nov 19, 2022 at 22:07
  • 2
    $\begingroup$ Why "not as secure"? If you are worried about attacks that search for small values, why aren't you equally concerned about attacks that search for values around 4787985879261692769246529503049509767911957330519830813409881797811302? Both attacks succeed with equal likelihood, and hence neither is a greater threat than the other. $\endgroup$
    – poncho
    Nov 19, 2022 at 22:11
  • $\begingroup$ @poncho, I'm not saying that large number is secure enough (I don't know how you generated), but if it was chosen randomly from [1, 2^256], then it's more secure in comparison with 741, because the latter comes from a range of numbers that is provably known to have been searched. $\endgroup$
    – Angelo M.
    Nov 20, 2022 at 10:30
  • 1
    $\begingroup$ Yes it’s a matter of chances. Why worry about something that will never happen? But feel free to make your CSPRNGs slower, biased and potentially introduce side channels that, unlike the stuff you’re worrying about, lead to actual attacks. The crypto community simply does not share your concerns, as you can see from other comments and answers, because they’re effectively impossible. $\endgroup$
    – swineone
    Mar 14 at 20:00

2 Answers 2

Reset to default
3
$\begingroup$

If that's true, do CSPRNG skip certain sub-ranges?

It's not true. In addition, even if it were true in some use cases, how is the CSPRNG supposed to know that are the weak values for any specific use case? Instead, the CSPRNG just supplies random bits, and if the application needs to avoid certain patterns (e.g. an all-0 value for use as a multiplier in ECC), the application can test for that and reject it.

So, no, CSPRNGs do not skip any sub-ranges.

Improve this answer
$\endgroup$
2
$\begingroup$

Statistically speaking, probability, that truly random number generated from range [1, 2^256] will be smaller, than 2^32 (as given in your example) , is 2^(-224), so negligible.

You can view truly random number generator as perfect coin, you flip that coin 256 times, write 0 when head lands, write 1 when tail lands, and you will have 256 bit binary number (that you can then transform to decimal). For that number to be smaller than 2^32, it would mean you would have to get heads at least 224 times in row, which will "never" happen.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Welcome to cryptography.se we have Latex mathjax enabled in our site. $\endgroup$
    – kelalaka
    Nov 20, 2022 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.