For any cryptographically-secure pseudo random generators, do we need a secure random seed for those? If the seed is predictable, then everything is broken due to the deterministic propetry of the algorithms.
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
3
Actually, your second sentence itself is the answer. A pseudo random number generator(cryptographically secure or not) is a deterministic algorithm which produce random looking numbers. Every time you provide the same seed it produces the same random looking numbers. Now, if your seed value is predictable and algorithm is public then the output of the deterministic algorithm is also predictable. So, the seed of a cryptographically secure pseudo random number generator must be secret, so that the output you get is unpredictable.
-
$\begingroup$ Can you elaborate on how to get a secret seed in practice? $\endgroup$– malleaCommented Apr 1, 2020 at 7:32
-
1$\begingroup$ We can take help of some hardware device like Trusted Platform Module(TPM). Though using a TPM chip is to some extend aristocrat. ThinkPad comes with it. Most of the cases seeds, keys, random numbers are generated using some software mechanism. In this process you gather randomness from multiple events and enrich a randomness pool. Events are like keyboard key pressing duration, current time, mouse movement, data transfer rate, etc. You do some compilation on the randomness pool and get the values. In linux systems /dev/urandom and /dev/random works like a randomness pool. $\endgroup$– RadiumCommented Apr 1, 2020 at 8:00
-
$\begingroup$ @mallea you can see the paper by Peter Gutmann: "Software Generation of Practically Strong Random Numbers" to get some broad idea. $\endgroup$– RadiumCommented Apr 1, 2020 at 8:01
$\begingroup$
$\endgroup$
2
Yes a CSPRNG does require a secret random seed.
Keeping cryptographic requirements in mind OS developers have given multiple sources for fetching a good enough seed from sources of high entropy, and they may be available in the form of APIs . For example arc4random() family of functions in BSD type operating systems. If the APIs are not available, then we ourselves have to , implement drivers/software to capture randomness, treating the user itself as a source (mouse movements, sensor pulses (if smartphone)), although this may not be reliable*. Then that data can be fed to some kind of hash function like SHA-2 / SHA-3 to generate the pseudo random output required. arc4random uses ChaCha20 to generate Pseudo randomness from the raw data, which is excellent, given the fact that ChaCha20 using an incremented 64 bit counter internally can output 1 Zettabyte of pseudo random data with good diffusion . I'm mentioning these algorithms because they have stood the test of time and extensively subject to both linear and differential cryptanalysis.
As a side note: When using other algorithms, you have to be careful though as CSPRNG's are notorious for being backdoored themselves, for example, the Dual_EC_DRBG 's kleptographic backdoors (that compromise the security of the random seed used), which made headlines .
But if the need for randomness is for generation of SSL certificates and thinks like that then it's better to rely on natural sources of entropy like radioactive decay. You can also use something simple like an army of lava lamps https://youtu.be/1cUUfMeOijg .
On further research on your question, I found this interesting :
In particular, data that is very random always has a high level of entropy, but data that has high entropy is not necessarily very random. https://www.google.com/amp/s/techbeacon.com/security/how-really-random-numbers-will-bolster-your-encryption%3famp
*In Linux we have /dev/urandom or /dev/random. But reading from it every time (like reading a file) is not recommended as the OS can run out of entropy and hence it can affect the performance of your application.
-
1$\begingroup$ This seems tangentially related to the question at best. $\endgroup$– MaeherCommented Apr 1, 2020 at 22:50
-
$\begingroup$ @Maeher In the comments of the previous answer to this question the OP wanted details on "how to get a secret seed in practice " , that's why in my answer I included some details $\endgroup$ Commented Apr 1, 2020 at 23:48