3
$\begingroup$
  1. Are there situations currently where a PRNG just will not do? Are there current situations where only a TRNG will be useful?
  2. What about if someone uses a cryptographically secure PRNG?
  3. What is the biggest use case (in terms of magnitude) for a TRNG that a PRNG can't solve.
$\endgroup$
1
  • 1
    $\begingroup$ I'm sure an OTP will be the main reason for TRNG's. I'd rather use a well seeded PRNG though, but that is not likely to be perfectly secure if it is assumed that the amount of seed / entropy is (much) smaller than the generated random bits. $\endgroup$
    – Maarten Bodewes
    Dec 28, 2023 at 0:33

3 Answers 3

2
$\begingroup$

Among use cases for TRNGs that (CS)PRNGs can't handle:

  • generating a One Time Pad, because we want information-theoretic security
  • generating the seed of a CSPRNG in an embedded environment where it is inconvenient to store the CSPRNG's state in permanent memory (EEPROM, disk), or we fear that that this permanent's memory could have leaked allowing prediction of the CSPRNG.

Problem with CSPRNGs is that they are deterministic, thus predictable for one who known their initial or current state.

$\endgroup$
2
$\begingroup$

A PRNG is a method for generating output that is unpredictable except by (1) someone who knows the secret seed (or sufficient internal state), or (2) who has more computing power than we know how to physically build. Furthermore, (3) we don't know how to prove mathematically that any of the algorithms we commonly use are really PRNG: the best we can do is have top cryptographers fail to break them.

A TRNG is a method for generating output that is unpredictable except (1) by someone who knows sufficient internal state of the TRNG. As far as we understand physics, breaking commonly used TRNG algorithms requires knowing the state after determining the TRNG output — it seems that time is not reversible.

By comparing those definitions, we notice three differences.

(1) Breaking a TRNG requires observing its internal state. Breaking a PRNG requires observing its internal state or its seed. This leads to the main reason TRNGs are needed: to provide an initial seed. Once you have a secret seed, you can use a PRNG to create output that nobody else can predict. But where do you get this seed? Thus, every computing device that needs to produce secret data (such as encryption keys) needs to either include a TRNG, or have some other way to seed a PRNG. It's possible to have a PRNG on a device without a TRNG, but it requires two things:

  • The initial seed needs to come from a trusted source, typically as part of the manufacturing process. If you trust the manufacturer to not include a bug or a backdoor in the device, then in principle you also trust them not to mess up or log the seed injection. However, injecting a seed tends to be somewhat difficult in practice: even injecting unique serial numbers, which need to be unique but not secret, is a bit of a manufacturing headache. And it's hard to audit the absence of logs (though it's also admittedly hard to audit the absence of backdoors in the finished product).
  • The seed needs to be refreshed every time the device loses power: the system must not boot twice with the same seed, otherwise the PRNG algorithm would produce the same output after every boot. This requires secure persistent storage that supports as many rewrite cycles as the device power-cycles, which is too much to ask for some types of devices (either because they use flash memory with a limited number of erase cycles, or because they use persistent memory that is not well protected against backup/restore attacks).

For this reason, most devices that have any security role need a TRNG. Many classes of devices tend to lack a dedicated TRNG component and instead try to use weak entropy sources such as event timing, but this doesn't work well in practice.

(1') Continuing on this difference, note that if an attacker can observe the internal state of a PRNG, they can predict all future output. With a TRNG, an attacker needs to maintain access to the internal state to keep knowing future outputs. The internal state can leak, for example, through side channel attacks where the attacker does not have permanent access to the device, or because the attacker gains access to a backup. This allows a TRNG to limit the effects of a partial compromise.

(2) and (3) are concerns if you're worried that the PRNG algorithm is breakable, either (2) theoretically or (3) practically. You can use the output of a PRNG as the key stream in a stream cipher, and conversely the key stream of a stream cipher is a PRNG. Thus the existence of a PRNG is equivalent to the existence of symmetric encryption with a fixed-length key. There is some mysticism about randomness, but really if you believe in practical symmetric encryption then you also believe in cryptographic pseudorandomess. So you need a pure TRNG (as opposed to a TRNG+PRNG hybrid) only if you don't believe in cryptography. If you only ever use one-time pads, then you need a TRNG to generate the pads. If you're willing to use symmetric encryption algorithms such as AES modes or ChaCha20, then using a (properly seeded) PRNG to generate the encryption keys does not weaken your security.

$\endgroup$
1
  • $\begingroup$ "don't believe in cryptography" doesn't read like a joke. Is it meant to be? $\endgroup$
    – Paul Uszak
    Dec 29, 2023 at 23:03
1
$\begingroup$

They are needed when you want to have a "private conversation" (Whitfield Diffie), that no entity in the Multiverse can break. Ever. For all time.

The concept is Information-theoretic security. See the One Time Pad tag. See this on how to use them, and this on how to make them.

Also, regarding comments you may have received, I point you to NOBUS. That is indicative of a long running prejudice on this site against OTPs. Perhaps related to NOBUS and perception manipulation. See The Art of Deception. Ignore it. Don’t take my word for it. Don’t believe me. Do your own work, your own thinking.

$\endgroup$
6
  • $\begingroup$ Could you clarify what you mean by "a long running prejudice on this site towards OTPs"? $\endgroup$ Dec 28, 2023 at 6:39
  • $\begingroup$ "towards" or "against" OTPs, I think it's rather the second, but I may be wrong $\endgroup$
    – kodlu
    Dec 28, 2023 at 7:03
  • $\begingroup$ @kodlu You're correct; against. There are many instances of senior contributors positing that OTPs are not usable & impractical, despite them having being successfully used for a century. It almost seems like a concerted disinformation effort, which leads to the question: Cui bono? $\endgroup$
    – Paul Uszak
    Dec 28, 2023 at 23:51
  • $\begingroup$ Can we consider this almost a conspiracy theory, Paul? :P $\endgroup$
    – Maarten Bodewes
    Dec 29, 2023 at 2:13
  • 1
    $\begingroup$ I've removed the last sentence about Xmas, cider & possible followup questions as it is not part of the answer; it would have fared better as a comment. Merry X-mas to you. $\endgroup$
    – Maarten Bodewes
    Dec 29, 2023 at 2:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.