Questions tagged [pseudo-random-generator]

In cryptography, a pseudo-random generator (PRG) is a deterministic procedure that maps a random seed to a longer pseudo-random string such that no statistical test can distinguish between the output of the generator and the uniform distribution. Pseudo-random generators have numerous applications in cryptography. For instance, pseudo-random generators provide an efficient analog of one-time pads.

56 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
590 views

Is this PRG secure?

$G$ is a secure PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$. Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$. Is $G'(S)$ a secure PRG? ...
5
votes
1answer
359 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
4
votes
0answers
201 views

is a MAC defined by a pseudo random generator secure?

Let $ G:\{0,1\}^*\rightarrow\{0,1\}^*$ be a length doubling PRG, and let $ \Pi=(Gen,Mac,Vrfy)$ be the following MAC scheme: $ Gen $ on input $ 1^n$ uniformly samples and outputs $ k\leftarrow \{0,1\...
4
votes
0answers
201 views

Feasible way to check n-dimensional equidistribution of PRNGs

I am currently gathering some test methods and test suites for random number generator qualities, and am a bit stuck at finding something feasible to test for n-dimensional equidistribution. As input ...
3
votes
0answers
365 views

Can we construct a PRF directly from a one way permutation function?

In Introduction to Modern Cryptography first a pseudo random generator (PRG) is constructed from a one way function (OWF). After that the PRG is used to to construct pseudorandom functions (PRF). Is ...
3
votes
0answers
186 views

Finding the cycle sets of an LCG

My LCG has the form: $$S_0 = k$$ $$S_{n+1} = S_n \times a + 1 \pmod m$$ Each choice of $k$ generates a different sequence but in some cases a sequence may just be a cyclic shift of another. In this ...
3
votes
0answers
288 views

Is a PRG that reveals the first bit of the input secure

Let $G:(0,1)^n \rightarrow (0,1)^{n+1}$ be a secure PRG. Define $G'(s):=s_1 ||G(s)_{2,...,n+1} $. ($||$ is concatenation, and the subscript $ _{2,...,n+1}$ means the last $n$ bits of $G$) I claim ...
3
votes
0answers
327 views

On the Definition of a PRG and a CSPRG

I've been looking at the definition of a PRG, here. This is a broader notion than a cryptographically secure PRG ("CSPRG"), which is described here. I am realizing that I am very confused by this ...
3
votes
0answers
235 views

Integer factorization based password authentication

After looking at this security issue at DjangoProject, I started to think in a password-based authentication that places the burden of PBKDF2 (or whatever is the hashing function) on the client. So I ...
2
votes
0answers
90 views

How does a hybrid argument work relating to PRG's?

How does a hybrid argument work relating to PRG's? I am working on a homework assignment where the problems say to use a hybrid argument to prove/disprove that something is a secure PRG, and I can't ...
2
votes
0answers
33 views

RNG and Mersenne twister learning resources for the amateur

I am a complete amateur in the area of random number generators. I would appreciate resources to begin learning. Also I would also like to learn about Mersenne twister. Resources that are easy on the ...
2
votes
1answer
92 views

Breaking a Mersenne-twister RNG with unsequential outputs

Pardon me for this newbie-ish question. I'm still a novice in cryptography . I have an application that outputs random numbers from 0 - 12 (endpoints inclusive) unsequentially (some outputs are thrown ...
2
votes
0answers
80 views

How many bits of cryptographic security do these XOR Mid-Square random numbers have?

This pseudo-random number generator uses only XOR and Mid-Square operations: Get one secret 128-bit truly random seed $R_0$ Generate a million secret $R_j$ by the recurrences (for $1\le j\le 1000000$)...
2
votes
0answers
217 views

Decentralized consent over a random number

Maybe, some of you remember having to pick one person during playing as kids. That person would than have to catch the others for example. The methods to pick given person often would either depend on ...
2
votes
0answers
252 views

Showing a generator based to pseudorandom function is also pseudorandom

First of all sorry for the bad title, this is an exercise I'm struggling with: Let $F_k$ be a pseudorandom keyed function (abbreviated to PRF) with key, input and output of length $n$. Define the ...
2
votes
0answers
64 views

Is the number still a CSPRN if we only allow an interval from a CSPRNG?

tr -dc 0-9 < /dev/urandom | fold -w 3 | awk '$0>=100 && $0<=200' What this line does: /dev/urandom (Linux) is proven to be a CSPRNG, that is ...
2
votes
0answers
92 views

Polynomial restriction for PRG

Say we have a PRG $G(l,x)$ that expands a random string $x$ to length $l$ and is pseudorandom for any $l$ polynomial in $n$ (where $n = |x|$). Is $G$ pseudorandom for any $x$ of arbitrary length? I'm ...
2
votes
0answers
277 views

How can I construct a distinguisher given an inverter?

Let $ PRG: \{ 0, 1\}^n \rightarrow \{ 0, 1\}^{n+s}$ be a pseudo random generator and let $A$ be an inverter that runs in polynomial time, specifically: $\large \mathbb P_{d \leftarrow PRG(U_n)}[ A(d) ...
1
vote
0answers
53 views

Is $f(g)$ a PRG if $f$ is a OWF and $g$ a PRG?

If we have a PRG $g$ and a OWF $f$, can we say that $g' = f(g)$ is a PRG? And what if $g$ stretches its input by a factor of 2?
1
vote
0answers
50 views

Would the result of encrypting weak random data via AES-128 with a CSPRNG-generated key be considered strong/secure random data?

I am trying to understand the security implications of using a well known block (or stream but in this example block) cipher like AES-128 to produce pseudo-random data. My specific question is would ...
1
vote
0answers
52 views

Alternative AES key expansion for CTR based random number generator

Daniel J. Bernstein proposes an alternative to NIST AES-CTR based deterministic random number generator (AES-CTR-DRBG). Instead of a less performant complex construction, he uses an standard AES-CRT ...
1
vote
0answers
81 views

Dependence of a Pseudorandom Function's Security on its Input/Output Spaces

Let $n$ be a security parameter and $F:\{0,1\}^{\ell_{key}(n)} \times \{0,1\}^{\ell_{in}(n)} \rightarrow \{0,1\}^{\ell_{out}(n)}$ be a keyed function which forms a family of Pseudorandom Functions (...
1
vote
0answers
116 views

Construction PRF from PRG

As discussed here, a classic and secure construction of PRF from PRG is: $F_k(x_1x_2\cdots x_n) = G_{x_n}(\cdots(G_{x_2}(G_{x_1}(k)))\cdots)$ where $G$ is a secure pseudorandom generator. I was ...
1
vote
0answers
507 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In ...
1
vote
0answers
272 views

show that G' is not a secure PRG even if G is

Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is. My first question is that in this case, how do I know what G ...
1
vote
1answer
124 views

A modification of the Blum-Micalli construction

Consider the following modification of the Blum-Micalli construction (denoted by BM): $G_l(x) = f^l(x) || BM^l(x)$ I am asked the following questions about it: Show it is a PRG of fixed stretch ...
1
vote
0answers
39 views

Pseudorandomness based on homomorphic multiplication property of Paillier cryptosystem

Given the instance $(n, g, \lambda)$ of Paillier cryptosystem with $\text{ord}(g) = n \lambda$ (symbols have their usual meaning), and $c = g^{na}$, is it possible to distinguish (computationally) $c' ...
1
vote
0answers
150 views

Indistinguishable encryptions and CPA-secure example

Let $ F $ be a PRF and $ G$ be a PRG with expansion factor $n \to n +1 $ For the following encryption scheme, decide whether it has indistinguishable encryptions and whether it is CPA-secure. ...
1
vote
0answers
97 views

Never design your own crypto…how to design a PRG

As a new learner of cryptography I have learnt from online tutorials and lectures not to design your own crypto. What I am trying to understand is the fundamental to designing PRGs to a given context ...
1
vote
0answers
122 views

Calculating t and epsilon for a computationally indistinguishable pseudo random generator

I have a PRG $G : \{0, 1\}^n \rightarrow \{0, 1\}^{2n}$. How would you go about calculating the optimal size of $n$ given that you have $$\epsilon = \cfrac{1}{2^{80}}$$ and, $t = 2$ years for a ...
1
vote
0answers
154 views

$G_f(x) = x \|f(x)$ is not a PRG with $\operatorname{DPT}$-computable function $f$

Let $f:\{0,1\}^* \rightarrow \{0,1\}$ be any $\operatorname{DPT}$-computable function. Show that $G_f(x) = x \|f(x)$ is not a PRG. Can anyone help me on understand how to prove this?
1
vote
0answers
106 views

Mersenne Twister's vulnerabilty with small-size distributions

C++ rookie here, trying to wrap his head around (CS)PRNGs. I (assume that I) already understand the concept of the Mersenne Twister being "broken" (i.e. not cryptographically secure) due to its ...
1
vote
0answers
155 views

How Are Linear Congruential Generator Multipliers Chosen?

There are several numbers that keep coming up when looking at certain random number generators, for example 6364136223846793005 is used in newer pcg-family algorithms and seems to draw it from ...
1
vote
0answers
327 views

Assume G(s) is a PRG, is the following also a PRG?

Let s be a n-length binary word and not_s its negation. Let G be a PRNG with expansion 2n. Prove that H1(s) = G(not_s) is also a PRG? Prove that H2(s) = G1(s)||G2(not_s) is also PRG. Given G1, G2 ...
1
vote
0answers
271 views

Pseudo-random function where the output is inverted using XOR

I'm looking to know whether or not this PRF is secure : $$F'(k, x) = F(k, x) ⊕ 1^n$$ knowing that $F$ is already a secure PRF for $$\{0, 1\}^n × \{0, 1\}^n → \{0, 1\}^n$$ with, for example, $n= ...
1
vote
0answers
1k views

Assume $G$ is a PRG. Proof that $G'$ is PRG?

Let $G: \{0,1\}^s \rightarrow \{0,1\}^n$ be a pseudorandom generator (PRG). Are the following PRGs? $G'(x) = G(x)_{0,\ldots,n-2}$ ($G'(x)$ drops the last bit of $G(x)$) $G'(x) = G(x) \oplus ...
1
vote
0answers
734 views

how to prove by reduction correctly?

some times when see a problem like : if some G is a PRG then G' is also a PRG. we prove this by reduction in the following way: we assume there is a Distinguisher A for G' and we construct ...
1
vote
0answers
117 views

Does using pseudorandom generator more than once cause security loss?

Everytime we use the generator with itself there is security loss. Even if this loss is not enough to loose all cryptographic security, there is still some small loss in security. Is there any way to ...
1
vote
0answers
46 views

HMAC for provable server distributed randomness

I have an application in which a user must use a high-entropy salt to salt a message. Due to the fact that I can not rely on the user to actually provide a strong salt, the server must provide this ...
1
vote
0answers
422 views

Proving pseudorandom generators

Can anyone please help me on how to prove or disprove (by counterexample) whether the following function $G'$ is a PRG (Pseudorandom Generator) given that $G$ is a PRG. $$G'(s) = \operatorname{trunc}...
1
vote
0answers
219 views

PRG variant as a commitment scheme

I would like to use a PRG in order to achieve the commitment properties (i.e. Hiding and Binding), however, if we look at a general PRG we cannot state that it has the Binding property. First I show ...
1
vote
1answer
368 views

Is F' a pseudorandom function when F is composed with G, a pseudorandom generator?

If $F$ is a pseudorandom function, is $F'$ also a pseudorandom function in the following: $$ F'_k(x)=F_k(G(x)) \space \space \text, $$ where $G$ is $a$ pseudorandom generator? Also, does the other ...
1
vote
1answer
265 views

Is there a password hash function with a human component?

Sort of Related: Is there a cryptographic hash function that can be performed with pencil and paper? One problem with hashing passwords is that the attacker has more of everything it seems. More ...
0
votes
0answers
17 views

How to make Lagged Fibonacci generator fail birthday test in Testu01

I am implementing a lagged Fibonacci generator(LFG) in C and want to test it in Testu01. I implemented mine the same way as in https://pthree.org/2015/05/29/the-lagged-fibonacci-generator/ by Aaron ...
0
votes
0answers
12 views

Lehmer random number generator cipher scheme with moving bits

Let's consider linear congruential generator: $X_{k+1} = a \cdot X_{k} \mod 2^{128}$ Such that $a$ is some number which for every 128-bit input $X_{k}$ from $0$ to $2^{128}-1$ will give us different ...
0
votes
0answers
33 views

When will the random bit sequence start to repeat in pseudo random number generator

Let's say we have the Blum-Micali pseudorandom number generator. from wikipedia: Let $p$ be an odd prime, and let $g$ be a primitive root modulo $p$. Let $x_0$ be a seed, and let $x_{i+1} = g^{x_i}\ ...
0
votes
0answers
44 views

Is it possible to compute permutations of a sequence of bytes by using exactly one pseudo-random number?

Suppose I have a certain sequence of bytes, for example 0102F4829hex, and I can pick from a pseudo-random number generator exactly one number. Is it possible, by using exactly one pseudo-random number ...
0
votes
0answers
21 views

How to save an encryption key to a binary file to be used in NIST STS

I wrote a simple logistics function that i use for my pesudo random number generator.I want to test it's randomness so i downloaded a custom windows version of NIST STS. the program rqeuires you to ...
0
votes
0answers
38 views

Any formal proof or reference that pseudorandom permutation can be used as pseudorandom function

Assume that a DRBG passes all statistical tests. We use that DRBG to shuffle(Fisher-Yates) an array that contains $\{0,1,\ldots,2^n-1\}$. Now get a pseudorandom permutation $\{0,1\}^n\rightarrow \{0,1\...
0
votes
0answers
22 views

safe concating PRP and PRG

Suppose it is necessary to build a safe PRG. You have one PRP with $\epsilon = \frac{1}{2} ^ {45}$, and one PRF with $\epsilon = \frac{1}{2} ^ {55}$. There is no mathematical relationship in the PRP ...