# Which test suit is better to say if PRNG is CSPRNG:TestU01 or NIST?

Actually my concern is that I am planning to apply xoshiro256+ for implementation of stream cipher https://prng.di.unimi.it/ for my cryptographic application. It passes the BigCrush tests. Will it provide me the same level of secuirty as any other cryptographically secure PRNG (CSPRNG)? On the webiste, they claim that xoshiro256+ is a general purpose PRNG and not to be used for cryptography. But I still want to find out how far this PRNG is from being CSPRNG, may be a mathematical expression because my limitation is speed and this seems to be very fast PRNG and remember that it passes BigCrush. My other question is that NIST statistical test suite https://www.nist.gov/publications/statistical-test-suite-random-and-pseudorandom-number-generators-cryptographic says that if a PRNG passes NIST tests then it is a CSPRNG. So how similar is BigCrush to NIST, again to know how far xoshiro256+ is from being CSPRNG?

P.S: I want to do a theoretical study of this issue as I am not well-versed in statistical testings practically on software.

• This question needs to be refined. How is this PRNG is getting used in relation to the implementation of a stream cipher? Why are you using xoshiro256+ when there are fast CSPRNGs that also pass standard test suites and have received extended cryptanalysis. Without a description of your crypto scheme it's hard to give good feedback. Apr 30 at 11:38
• @BlamKiwi Useless factoid: xoshiro256+ is used for NIST's ea_iid test implementation within SP 800-90b. Apr 30 at 12:08
• By examining a PRNG's output, it's sometime possible to determine that it's not a CSPRNG. But to determine that it's a CSPRNG, it's necessary to examine the PRNG's design/specification; it's not possible from the PRNG's output alone.
– fgrieu
Apr 30 at 12:24
• Does this answer your question? What tests can I do to ensure my random number generator is working correctly?
– D.W.
Apr 30 at 20:50
• – D.W.
Apr 30 at 20:51

TestU01 or NIST?

Neither. Trust what they say on the xoshiro256+ website. A CSPRNG is not defined by it's speed. It's defined by security against predictability, i.e. the next bit test. And that's determined by it's construction.

All that TestU01, NIST's STS and all the others do is check for uniform randomness of output (within a certain degree of confidence). A good PRNG will pass, as will a good CSPRNG. I don't think that a mathematical expression can be formed to enumerate the difference between an invertable PRNG and a non-invertable CSPRNG, other than something derived from $$\text{xoshiro256+} \ne \text{CSPRNG}$$. See note.

It's as mathematically defining the difference between apples and bananas.

My other question is that NIST statistical tes...

They say that because they are talking specifically from a computer security perspective. That's their raison d'etre. As in the last word of your linked title :-) NIST is not interested in PRNGs.

Note. With hindsight, something may be possible along those lines. Formulae can be written to invert PRNGs. How Brittle Are LCG-Cracking Techniques? discusses this with extensive formulae/code for a simple PRNG. No complete formulae are (yet) possible for inversion of a CSPRNG. This is a form of mathematical distinction if you will.

• Actually, my concern is that I want CSPRNG with ultra high speed. I can use Salsa20 or ChaCha or AES counte moder but I don't know how fast they can generate random sequences. Can they support a rate of 200Gbps? Can you please comment on that? May 3 at 10:18