On a related note of building my own RNG, as someone suggested to use several commericial solutions how can I check if it is rigged against me? (although I am still strongly biased to a homebrew solution that is designed to be hard to subvert, taking the shortest possible route from a quantum random source to the ADC)
$\begingroup$
$\endgroup$
2
-
2$\begingroup$ No way to tell really. The output of a CSPRNG would be indistinguishable from a TRNG. Only by inspecting what the actual hardware does would you be able to verify it. $\endgroup$– otusDec 14, 2015 at 11:53
-
$\begingroup$ @otus I am okay with a good CSPRNG with a good entropy feed. The problem is about subverted RNGs like the ECDRBG NSA backdoor. How can I tell if my commercial RNG chip is rigged in that way? $\endgroup$– Maxthon ChanDec 15, 2015 at 1:30
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
While unfortunately that is not possible deterministically, if you have a small amount of "guaranteed trustworthy" randomness, you can use several untrusted RNGs together to generate an unlimited supply of good randomness (under some weak assumptions of non-signaling between the RNGs). This is called "randomness expansion" and I am not aware of any use in practice yet, unfortunately.
See these papers by Colbeck and Kent and Coudron and Yuen
