On a related note of building my own RNG, as someone suggested to use several commericial solutions how can I check if it is rigged against me? (although I am still strongly biased to a homebrew solution that is designed to be hard to subvert, taking the shortest possible route from a quantum random source to the ADC)

  • 2
    $\begingroup$ No way to tell really. The output of a CSPRNG would be indistinguishable from a TRNG. Only by inspecting what the actual hardware does would you be able to verify it. $\endgroup$
    – otus
    Commented Dec 14, 2015 at 11:53
  • $\begingroup$ @otus I am okay with a good CSPRNG with a good entropy feed. The problem is about subverted RNGs like the ECDRBG NSA backdoor. How can I tell if my commercial RNG chip is rigged in that way? $\endgroup$ Commented Dec 15, 2015 at 1:30

1 Answer 1


While unfortunately that is not possible deterministically, if you have a small amount of "guaranteed trustworthy" randomness, you can use several untrusted RNGs together to generate an unlimited supply of good randomness (under some weak assumptions of non-signaling between the RNGs). This is called "randomness expansion" and I am not aware of any use in practice yet, unfortunately.

See these papers by Colbeck and Kent and Coudron and Yuen


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.