3
$\begingroup$

To be able to generate random numbers for lottery games, we have the following requirement:

The random number generator, which uses the deterministic algorithm to determine the game result, has to work with a length of at least $$2^{64}$$ period to ensure that the random process is generated so that in the case of a particular gambling there is no detectable repetition of the results, and must produce a sequence of game results based on initial values that are random or unpredictable

What does it mean in terms of certifications and hardware random number generators?

Am I able to fullfill the requirement with hardware device which is compliant with P2 Class of BSI AIS-31 (for example CryptoMate64 USB cryptographic dongle or other HW certified cryptographic device according FIPS 140-2 Level 3)?

Improve this question
$\endgroup$
9
  • 3
    $\begingroup$ Please tell me this is homework, and you don't intend to use advice you got from the internet to design a real lottery... $\endgroup$
    – poncho
    May 15, 2017 at 16:03
  • $\begingroup$ what should the result look like? if you want 1-1 input-output mapping of a 2^64 space, u can use a PRP (a block cipher of input and output of 64 bit) $\endgroup$
    – crypt
    May 15, 2017 at 16:14
  • $\begingroup$ I need to generate different 10 000 random numbers from interval 1 to 100 000 000. But it can be used as 1-1 input-output mapping which can be ran 10 000 times. So you think that 3DES would be enough (64 bit blocks)? $\endgroup$
    – user1563721
    May 15, 2017 at 17:15
  • $\begingroup$ @poncho it is part of my cipher course to understand how random number generators work in real world, with cryptographic hardware, and I am trying to understand it also from the point of view of standards and norms $\endgroup$
    – user1563721
    May 15, 2017 at 17:17
  • $\begingroup$ I guess you can use the dongle to retrieve (and afterwards, securely destroy by overwriting in RAM) the initial seed and then use a software DRBG (that complies with FIPS) to do the rest. Even if secure, you may not want to request 10K numbers in the interval 1..100 000 000. Note that usually the TRNG is already coupled with a DRBG for AIS-31 compliance. You also need an algorithm that generates a value between 1 and 100 000 000 using the software DRBG. $\endgroup$
    – Maarten Bodewes ♦
    May 15, 2017 at 18:16

1 Answer 1

Reset to default
4
$\begingroup$

The wording of this requirement contains the meaningless

has to work with a length of at least $2^{64}$ period

that I hereafter reorder into

    has to work with a period of length at least $2^{64}$

We need to solve the ambiguity left in

must produce a sequence of game results based on initial values that are random or unpredictable

about if random or unpredictable applies to initial values or to game results. Because of the earlier text "deterministic algorithm to determine the game result", the game results can't be random, since that opposes squarely to deterministic. Thus random or unpredictable can only apply to initial values. We are left with a sequence of game results that is never prescribed to be unpredictable, and the requirement is perfectly met by a generator that

  • uses 8 throws of 8-sided dices to build a 64-bit seed initializing a 64-bit counter;
  • at each uses, increments the counter modulo $2^{64}$ and outputs it.

Yet this generator is clearly unsuitable for a lottery, because the next result is trivially inferred from the previous one.

Also missing is the range of game outcomes ($2^{64}$ outcomes as in the above example is unheard-of in lotteries); a requirement that these game outcomes are equiprobable, and to what degree; if two outcomes in the sequence generated from the same seed can repeat (they should not in something that mimics a traditional loto).

Ah, and if we take it to the letter, it seems we must have a period of at least $2^{64}$ for all seeds, and that condition is not part of P2 Class of BSI AIS-31 or FIPS 140-2 Level 3. Therefore, game outcomes determined by some deterministic memory-less function from output of generators certified by these standards arguably can not meet the requirement. Further, AIS-31 allows (or requires for some class) that the generator is reseeded while used, when the requirement asks for something deterministic except for seed.

In the end, even after it has been reordered, the requirement remains utterly technically defective, and arguably prevents using established RNGs. The best is to ignore this requirement entirely and start afresh, if that can be done without getting fired poorly graded.

To engineer sound requirements, we must know the intent. It could be that the seed is archived, so that it can be proved afterwards that the PRNG worked correctly. It could be that this archival is distributed, so that collusion of some number of dishonest parties in the archival process would be necessary to predict the outcome. Again there's the range and rules for outcomes. There are assumptions to be made on what is trusted, and what's not.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ You know what? Considering some of the homework questions posted here (presumably set by knowledgeable teachers), I'm glad l didn't do any cipher courses and learned what I have from this site instead. Thanks all. $\endgroup$
    – Paul Uszak
    May 17, 2017 at 23:57
  • $\begingroup$ @fgrieu you are absolutely right about the wording and randomness of initial values. But your answer is very good to understand how it works and what we should ask. And when I would like to have proof afterwards, that PRNG worked correctly and to prove about game results I think it could be solved by using CSPRNG and archive generated Entropy which was used a seed for CSPRNG. $\endgroup$
    – user1563721
    May 18, 2017 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.