Mellisa O'Neil tested Xoroshiro128+ with 512 terabytes (2^49 bytes) of data. And finally it failed. Would AES fail PractRand with enough data?
When we can expect that AES will fail? Maybe with $2^{64}$ of data?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityMellisa O'Neil tested Xoroshiro128+ with 512 terabytes (2^49 bytes) of data. And finally it failed. Would AES fail PractRand with enough data?
When we can expect that AES will fail? Maybe with $2^{64}$ of data?
Of course $AES_{K_1} \oplus AES_{K_2}$ will pass as that's a pseudorandom function. One $AES$ isn't meant to be. But how can you prove that empirically?
PractRand is written by one guy (sorry Chris). It's not used in the mainstream literature. TRNG's are principally validated using dieharder or NIST STS. Randomness has been well studied but PractRand hasn't. Therefore you can't rely on some arbitrary code to disprove much researched mathematics.
And these suites aren't that clever anyway. RC4 passes all of them, and the Twister passes 95% of them, yet... And consider the huge flaws in diehard, but we still use it. Therefore Tom, the question is kinda moot.