0
$\begingroup$

How good is blake3 for generating pseudo-random bitstrings in comparison to a random oracle?

Let's say we generated an arbitrarily long pseudo-random bitstring by concatenating blake3 hashes together in the following manner:

blake3(seed) || blake3(seed + 1) || blake3(seed + 2) || ... || blake3(seed + n)

How good (in terms of quality) would a block of random bits generated in this manner be?
I was extensively searching for any results of TestU01 (BigCrush), PractRand, Diehard, and NIST STS tests performed on a PRNG based on blake3, but I couldn't find anything. I would appreciate it if anyone could link me something or explain why this would/could/wouldn't be a good way to generate pseudo-random bits.

I'm not concerned about seed being public, backtracking, future prediction, speed, or anything but the quality of pseudorandom bits generated in this manner.

UPDATES:
Running NIST Statistical Test Suite on 1GB of blake3 concatenated hashes.
I gave up for today (took too long). Might try again tomorrow and post the results. I ran it on 10MB and it passed.

Improve this question
$\endgroup$
2
  • 3
    $\begingroup$ Why not use it as XOF? E.g. b3sum has a -l function to indicate the number of bytes that need to be produced. What you are trying to achieve has already been defined in a different way. $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 29, 2023 at 0:57
  • $\begingroup$ That's a good point! I'll look into it. Thanks! $\endgroup$
    – TypicalHog
    Commented Dec 29, 2023 at 1:21

1 Answer 1

Reset to default
1
$\begingroup$

What you are asking is equivalent to asking how broken Blake3 is. If you can distinguish output of a cryptographic hash from a random oracle, it's considered broken[1].

The answer is that as far as anyone knows, it's not broken.

[1] https://en.wikipedia.org/wiki/Distinguishing_attack

Improve this answer
$\endgroup$
5
  • $\begingroup$ I disagree that the question is about how broken is Blake3. From comparing with a random oracle, no single hash function can be indistinguishabile no matter how clever the design is. That doesn't mean that we consider sha3, blake2 to be broken in any way. $\endgroup$
    – Marc Ilunga
    Commented Dec 29, 2023 at 1:07
  • $\begingroup$ Theoretically a distinguisher exists, but any distinguisher that's better than brute force is considered a break. $\endgroup$
    – LightTunnelEnd
    Commented Dec 29, 2023 at 1:20
  • $\begingroup$ I just need it to pass all existing randomness tests. $\endgroup$
    – TypicalHog
    Commented Dec 29, 2023 at 1:29
  • $\begingroup$ @TypicalHog, as Maarten said in another comment, if you use a properly designed XOF you'll be fine for your use case. $\endgroup$
    – Marc Ilunga
    Commented Dec 29, 2023 at 10:35
  • $\begingroup$ @LightTunnelEnd, this is not so much a brute force, what I am referring to is a fundamental theoretical limitation. Consequently, talking about "indistinguishability from a random oracle" for a given hash function is kind of ill-defined. Nevertheless, we can make other formalization/statements about RO-like behaviour of good hash functions. See these papers: ia.cr/1998/011, ia.cr/2003/161 $\endgroup$
    – Marc Ilunga
    Commented Dec 29, 2023 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.