3
$\begingroup$

I read that random numbers are being used in cryptography and security. I think I have idea how to truly generate true random, non-deterministic number. But before continuing further I'd like to ask few basic questions.

  1. What kind of numbers are needed for cryptography/security? Are those integers?
  2. How long should those numbers be? 10 digits, 100 digits?
  3. I read few articles about random numbers, but did I get it right, they are used to create hashes to create stronger encryption?
Improve this question
$\endgroup$
9
  • 11
    $\begingroup$ I think I have idea how to truly generate true random, non-deterministic number. Could you explain it further how you would do it? $\endgroup$
    – AleksanderCH
    Feb 5, 2019 at 14:44
  • 13
    $\begingroup$ It obviously is 4. $\endgroup$
    – Ivan Kolmychek
    Feb 5, 2019 at 16:44
  • 2
    $\begingroup$ @FosAvance That would already be a thing: for example, certain cryptocurrency wallets generate keys by having the user move a mouse in a "random" pattern. IIRC, there's also generators that use nanosecond differences between keyboard events. $\endgroup$
    – user65657
    Feb 5, 2019 at 21:05
  • 5
    $\begingroup$ @IvanKolmychek: You mean "nine", right? $\endgroup$
    – Ilmari Karonen
    Feb 6, 2019 at 0:26
  • 2
    $\begingroup$ Here's an obvious example, taking your question title literally and representing a random 256-bit value as an integer: 34709450559138105993256122137106662498420252743092410037734641373678685524291. $\endgroup$
    – forest ♦
    Feb 6, 2019 at 5:07

2 Answers 2

Reset to default
16
$\begingroup$

What kind of numbers are needed for cryptography/security? Are those integers?

Bits. Simply have your TRNG generate random bits.

As mentioned in the other answer, the only difference between bits/hex/integers/etc is in the formatting and representation. It is almost certainly more appropriate and simpler to generate random bits than it is to rely on some process to generate a random integers in a given range.

How long should those numbers be? 10 digits, 100 digits?

256 bits is sufficient for any one user. You can take a 256-bits of uniformly random information and use it to generate an arbitrary amount of uniformly random information (for practical purposes) using a CSPRNG.

I read few articles about random numbers, but did I get it right, they are used to create hashes to create stronger encryption?

  • Random numbers are not required to create hashes
    • Typical hash functions are deterministic algorithms
    • Random numbers may be used as part of an input to a hash function, depending on context
  • Hashing is not related to encryption
    • The two are sometimes used in conjunction, but encryption is not (typically) built from hash functions
  • "stronger encryption"
    • Random numbers are required to securely use a cipher (e.g. for keys, IVs)
    • But the algorithms themselves such as AES and ChaCha are nigh unbreakable and so cannot be "stronger"
Improve this answer
$\endgroup$
8
  • 8
    $\begingroup$ "You can take a 256-bits of uniformly random information and use it to generate an arbitrary amount of uniformly random information using a CSPRNG." I would not call the output of a CSPRNG uniformly random information. Perhaps computationally indistinguishable from uniformly random information, or uniformly random information for practical purposes. $\endgroup$
    – fgrieu ♦
    Feb 5, 2019 at 16:32
  • 7
    $\begingroup$ @FosAvance A persons movement while situated in front of a computer is actually highly predictable; They don't move very much. Also: a modern computer already takes advantage of information based on user interaction to extract entropy. Information related to events such as key presses and mouse movement/clicks are fed into an entropy pool. None of that changes the recommendations of the above answer however. $\endgroup$
    – Ella Rose
    Feb 5, 2019 at 16:53
  • 7
    $\begingroup$ @FosAvance sure, but Ella's point is that the concept of using human movements as a source of entropy (jitter of mouse movement or accelerometers in mobile devices) isn't novel, it's already very commonly used in practice. $\endgroup$
    – Peteris
    Feb 5, 2019 at 20:42
  • 3
    $\begingroup$ @FosAvance Regardless of what you had in mind, you should use the OS (secure) RNG. It collects a lot more data, including data not accessible to userspace programs. That includes randomness contributed by mouse/keyboard/touchscreen/accelerometer data and also sources you wouldn't think of using. It will securely processes non-uniform correlated input (in a way that's not susceptible to bad data), use output derivation algorithms which cannot be reversed, and is free of statistical defects. (When you need raw bits use a system call like getrandom. It's preferable to /dev/(u)random.) $\endgroup$
    – Future Security
    Feb 6, 2019 at 3:07
  • 2
    $\begingroup$ You may want to note that 256 bits represent an integer anywhere from $0$ to $2^{256}-1$. $\endgroup$
    – forest ♦
    Feb 6, 2019 at 4:13
2
$\begingroup$

I think I have an idea how to truly generate true random, non-deterministic numbers.

If you have a normal computer you actually can't create truly random numbers, unless you have dedicated hardware (hardware random number generator) that produces truly random numbers. If you don't have that then the best you can do are Cryptographically secure pseudorandom numbers.

What kind of numbers are needed for cryptography/security? Are those integers?

Once you have a random number you can also change the representation of it, for example an interger, Hex, binary, etc. It depends on the usage.

  • Do you need a salt? $\rightarrow$ alphanumerical
  • Do you need it for mathematical cryptography like asymmetric encryption? $\rightarrow$ integer
  • $\ldots$

How long should those numbers be? 10 digits, 100 digits?

Depends:

  • The encryption scheme known as RSA uses fairly large prime numbers i.e. 1024-bit ($\approx$ 310 digits). You generate a 1024-bit number and increment the number until you have reached a prime number. This answer gives some additional information.

  • If you want to create a simple coin-toss application you only need to produce a 1-bit random value (i.e. $0 =$ head, $1 =$ tails).

[$\ldots$] did I get it right, random numbers are used to create hashes to create stronger encryption?

Random numbers have a large application (especially in cryptography).

About hashes:

Hashes are deterministic. That means that some input always has exactly the same hash-value. No matter when, where or anything, an identical hashing-algorithm creates always the same hash-value for an identical input. The idea of random numbers is that they create (almost every time) a different number.

Encryption:

Random numbers indeed play an important role for encryption. Almost every encryption-scheme makes use of random number generators.

Improve this answer
$\endgroup$
2
  • 8
    $\begingroup$ “If you have a normal computer you actually can't create truly random numbers” This is not true. It is very common for a computer these days to include a hardware entropy source (RDRAND on Intel, hardware RNG on most smartphones, even many microcontrollers include an RNG these days). “Cryptographically secure random numbers” I think you meant pseudorandom, otherwise the whole paragraph is useless — but it's actually wrong. $\endgroup$
    – Gilles 'SO- stop being evil'
    Feb 5, 2019 at 16:12
  • $\begingroup$ Also the entire machine can be made to act as a TRNG. You can code a jitter application yourself, or use something like haveged $\endgroup$
    – Paul Uszak
    Feb 5, 2019 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.