So I was contemplating this answer to my last question, and it got me thinking:
If I understand it right, one of the required properties of a CSPRNG is that it resists leaking information about its internal state from the outputs it produces.
So say we have a PRNG that meets all other properties of a CSPRNG (I do not yet trust myself to know what all those are), but is suspected of leaking too much of its state in the outputs.
My intuition is that we can maybe make it a CSPRNG by running its outputs through a hashing algorithm already known to be suitable for cryptography.
An example: say the PRNG has 128 bits of state, and produces 128-bit numbers as its output. If I were to, say, run it 8 times, I would have 1024 bits. Say I then feed that into SHA-512/256 or similar, and return the two 128-bit pieces of the digest as the new outputs.
So in this example I get two outputs of my new composed PRNG for every eight runs of the underlying PRNG. This might be less efficient than a proper CSPRNG, and might have washed out whatever other properties the PRNG might have had. But is it now a CSPRNG?
I suspect the answer is either "no" or "only if the original PRNG [...]" or maybe at best "the general gist is in the right direction but your specific example would not be because [...]", or some combination of those.
I also know that naive attempts to compose primitives like this without proper understanding can actually cause other problems.
It just occurred to me that some operations, like XOR and the hashing functions used in cryptography, can "destroy" information, in the sense that more than one possible input can produce the same output, while still retaining the right "randomness" properties.
That naively seems like what we need to reduce how much a PRNG's outputs reveal about its state, and I'm looking for some check if that is right or in what ways it is wrong.
And it seems like "can I turn a PRNG into a CSPRNG by running a secure hash on all of its outputs?" is a good question to explore at least some of that.