1
$\begingroup$

In the original paper, Marsaglia defines the xorwow() function and gives some example values for the initial state of $x$, $y$, $z$, $v$, $w$ and $d$. But it is not clear to me, how these values have been chosen, or how they can be "randomized" from a seed. The paper doesn't go into detail here. Wikipedia has a slightly different xorwow() code (should be equivalent, I think), but again doesn't say how to initialize the state - except that "the state array must be initialized to not be all zero in the first four words".

So, it is "safe" to initialize all 6 state variables with completely random data, e.g. taken from the operating system's entropy source? Or do any of these variables need to be initialized in a specific form to get "good" random numbers? For example, did Marsaglia choose some "magic" values that perform best? Also, what about the counter $d$? Should $d$ even be randomized?

$\endgroup$
1
  • $\begingroup$ Note that you can use MathJax / $\TeX$ between dollar signs (e.g. $x$) and code (e.g. xorwow()) between backticks on this site. $\endgroup$
    – Maarten Bodewes
    Mar 19 at 12:37
6
$\begingroup$

OK, first things first. DO NOT UNDER ANY CIRCUMSTANCES USE XORWOW TO GENERATE ANY CRYPTOGRAPHIC SECRETS OR VALUES THAT SHOULD BE UNPREDICTABLE TO AN ADVERSARY.

Sorry to shout, but it is very important to point out that xorwow is not a cryptographically secure random number generator; it's an LFSR with a fake moustache.

I'm not sure why the wikipedia comment says that the first four need to be non-zero. In particular the states (0, X, 0, 0, 0), (0, 0, X, 0, 0), and (0, 0, 0, X, 0) would all transition to (0, 0, 0, 0, X) and would therefore presumably also be weak. It's important as with all LFSRs not to load up the register with all zeroes (so the first five variables should not all be zero). Also avoid setting the increment to an even value (the number 362437 in the wiki code). If you follow these two conditions the state will cycle through all $2^{192}-2^{32}$ values and different seeds just make you start at different points on the cycle and are pretty much equivalent. There's a small issue if the registers begin in a very spare state, they only slowly evolve out of being sparse, but over a large number of calls this will smooth out.

This would make the generator suitable for e.g. generating values for Monte-Carlo integration of a real valued function. BUT IT'S STILL NOT SUITABLE FOR ANY CRYPTOGRAPHIC PURPOSE. (sorry again for shouting).

$\endgroup$
2
  • $\begingroup$ Okay, I understand it is not a "cryptographically secure" RNG. Still I would like to ensure that we get a different sequence of numbers (or that we start at a different point in the very long sequence) every time. If I get you right, the state variables $x$, $y$, $z$, $v$ and $w$ can be set to completely "random" initial values without breaking the properties of the RNG. But what about the counter $d$? $\endgroup$
    – user87878
    Mar 19 at 14:09
  • $\begingroup$ Yes $d$ can be initialised to any value (including 0) $\endgroup$
    – Daniel S
    Mar 19 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.