# Choice of delta-neighbors in Balloon Hash algorithm

Reference Document: https://eprint.iacr.org/2016/027.pdf

According to appendix D section 4 definition 27

each vertex in V has predecessors sampled independently and uniformly at random from the set U

It appears from the pseudo-code in section 3.1 step 2b, and the reference code given on GitHub hash_state_mix(), that this has been implemented by the authors as some form of squeezing bits out of the hash function; however my question is could it just as easily have been done with Mersenne Twister or is there another reason why the hash is required?

• I'm not so sure that the PRNG in this case must be a CS one since the only thing the PRNG does is select which blocks to pull out; however Mersenne Twister as you point out has other issues which makes it a poor choice. Is there maybe another low-overhead PRNG that's uniformly random over uint64_t – Gregor y Jun 12 at 2:14
• The lack of implementation documentation. As far as I can tell the PRNG used is hash(salt)[i..i+d];i+=d+1, but what happens when d runs off the end? – Gregor y Jun 12 at 2:33
• besides it's already going to be 'incompatible' because in the GitHub code: neighbor % s->n_blocks has pigeonholes – Gregor y Jun 12 at 2:54