# XOR for more TRNG data?

If I have TRNG data as input (A1,A2,B1,B2,C1,C2) - can I xor it to provide more TRNG data A,B,C,D,E,F,G,H ?

A1 = TRNG1
A2 = TRNG2
B1 = TRNG3
B2 = TRNG4
C1 = TRNG5
C2 = TRNG6

A = A1 ⊕ A2
B = B1 ⊕ B2
C = C1 ⊕ C2
D = A2 ⊕ B1
E = B2 ⊕ C1
F = A1 ⊕ B2
G = A2 ⊕ C1
H = B1 ⊕ C2


EDIT:

⊕ is XOR operation, TRNG is true randomness generated from non computational source

• Hint: in your example, what is $A \oplus B \oplus D \oplus F$? Is that what we would expect from random data? Jun 22, 2023 at 13:04

I think what you are trying to build is a Pseudo Random Generator PRG. I usually define them with the expansion property. The expansion means, that given a small amount of random numbers you can securely generate a bigger amount of random numbers.

Next we need to find your setup, what does an adversary see? If he only sees A to H I would assume the system is still secure and the numbers appear random to him. (In this case you don't have expansion) But if the adversary sees A1 to C2, I would not assume security. (In this case you have expansion)

The reason is quite simple. For security of a PRG the adversary is not allowed to distinguish the generated numbers from real random numbers with a probability greater than zero. But if you give him A1 to C2 and A to H he can just assume, that he archived it in this order (which happens with probability z). In that case he can check whether the given equations work out, which happens only with negligible probability for real random numbers, but with probability 1 in your example. Therefore with probability 0.5 (guessing) plus z he can distinguish both cases. Because z is not negligible, your PRG is not secure.

I tried to make the answer simplified without going into detail with all the math behind it, because your reputation seems low. If you want the more mathematical answer, just comment :D

• Thank you. This was welcomed comment. I am after understanding better non computational TRNG use cases. Does XOR'in two TRNG sources make PRG? Jun 23, 2023 at 1:17

Titanlord's answer is good from a security /crypto perspective. My rule of thumb regarding TRNGs is:-

A system is not a TRNG if you can mathematically state how more information is externalised than is generated internally.

Or in sorter form: entropy out $$\not >$$ entropy in. That's the basis of Kolmogorov randomness:-

"It seems natural to call a chain random if it cannot be written down in a more condensed form, i.e., if the shortest program for generating it is as long as the chain itself." - Andrey N. Kolmogorov.

TRNGs are physical devices with height, weight and sometimes smell. I have one that needs 8 no. M12 bolts to hold it together. They consume energy (mechanical or electrical) and collect dust. You cannot simply XOR "more" TRNG stuff. That's effectively what you meant by "computational source". If each TRNG generated one random bit, A1 - C2 would produce six bits, yet the A - H computation produces 8 bits. And all are inseparably related to A1 - C2.

Yet if the A - H computation was a little more complex, perhaps featuring some type of cryptographic primitive(s), then you'd have a seeded PRNG nor pseduoTRNG (depending on which end you start with).

• This was something I was after: "entropy out ≯ entropy in" - would be nice to have source material for this? Jun 23, 2023 at 1:19