I am a relative crypto noob; please aim your answers accordingly. :)

I'm planning to port the ISAAC CSPRNG algorithm to modern C++. I'm looking at Bob Jenkins' reference implementations: http://burtleburtle.net/bob/rand/isaacafa.html

As I understand it, ISAAC has an internal state (mm) of ~259 uint32s, and it uses that state to produce a block of 256 uint32 outputs (randrsl) at once. Producing that block of 256 outputs is the job of the isaac() function.

But in Jenkins' reference implementations there is also a function called randinit(). It looks like this function takes in a user-provided 256-word seed and initializes the mm array with a scrambling of the user-provided bits. The code to scramble these bits is 2x or 3x the length of the code for isaac() itself.

Apparently Jenkins' original paper on ISAAC claimed that it "has no bad initial states, not even the state of all zeros."(secondhand source)

The randinit function seems to pre-date by more than a decade Aumasson's 2006 paper that claims to identify many weak initial states; so I deduce that it is not the case that randinit was introduced in order to avoid those particular weak states.

So why go through all this extra scrambling — if Jenkins believed that there were no bad states, why did he not copy the user-provided seed directly into the mm array? Or, why not use ISAAC itself to do the scrambling, by copying the user-provided seed directly into mm and then discarding the first few thousand outputs of isaac()?

  • $\begingroup$ Can I assume you've seen burtleburtle.net/bob/cplus/isaac.hpp ? $\endgroup$ – Paul Uszak Sep 1 '17 at 20:37
  • $\begingroup$ @PaulUszak: Yes. That header file is crazy bizarre C++ (hence my desire for a clean modern version that models the RandomUniformBitGenerator concept); and it still doesn't help me understand the purpose of randinit(). In fact isaac.hpp adds a second public method, srand(), that also sets the initial state but doesn't do the shuffling that randinit() does! $\endgroup$ – Quuxplusone Sep 1 '17 at 22:59
  • $\begingroup$ Yeh, I got a D- in C++. My Java implementation throws away the 1st round of output due to possible biases from poor seeding. Could this be relevant to your last sentence? $\endgroup$ – Paul Uszak Sep 1 '17 at 23:05
  • $\begingroup$ @PaulUszak: Yes, I'm roughly familiar with the idea of "possible biases due to poor seeding". But if Jenkins believed that ISAAC had, quote, "no bad initial states", and if even you believed that just discarding a few blocks was good enough, why did Jenkins write such a massive and complicated randinit function? $\endgroup$ – Quuxplusone Sep 2 '17 at 19:13
  • $\begingroup$ Also, would someone mind tagging this question [csprng] [isaac] [seed]? $\endgroup$ – Quuxplusone Sep 2 '17 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.