Skip to main content

Questions tagged [random-number-generator]

A random number generator is a software or hardware solution which functions as a generator of (real or pseudo) random numbers (or bits).

Filter by
Sorted by
Tagged with
26 votes
4 answers
14k views

What tests can I do to ensure my random number generator is working correctly?

In the past I have used the Chi-squared test to check the statistical randomness of my generator. Is this a good test to use? Are there other tests?
this.josh's user avatar
  • 2,007
31 votes
2 answers
6k views

Blum Blum Shub vs. AES-CTR or other CSPRNGs

Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
Polynomial's user avatar
  • 3,527
36 votes
5 answers
13k views

The GCD strikes back to RSA in 2019 - Good randomness is the only solution?

When someone collects lots of RSA public modulus, the first thing that comes to mind is; $$\text{GCD them all}$$ If you calculate the GCD of two different RSA modulus and if the result is not 1 then ...
kelalaka's user avatar
  • 49.1k
31 votes
4 answers
6k views

How to fairly select a random number for a game without trusting a third party?

Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.) Can this be done such that each player has the power to be ...
billpg's user avatar
  • 711
40 votes
5 answers
31k views

What is the difference between CSPRNG and PRNG?

What is the difference between CSPRNG and PRNG? Is there performance differential between them? For example: We use PRNG for key generation which is very expensive and CSPRNG for IV/nonce in block ...
randomness's user avatar
17 votes
5 answers
3k views

Creating a small number from a random octet string

I'm trying to figure out the best way to generate a cryptographically secure random number between 0 and 200 (inclusive) from a cryptographically secure random string of bytes (ie. read from /dev/...
neubert's user avatar
  • 2,939
17 votes
4 answers
5k views

Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

I want to use a hash function to generate a random sequence from number 0-n. And so I would like to find a good function that results in values that are seemingly random (does not need to be secure), ...
Thaina's user avatar
  • 293
16 votes
2 answers
16k views

Predicting values from a Linear Congruential Generator

I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form: ...
Flash's user avatar
  • 263
14 votes
5 answers
3k views

How to prove the security of the PRNG?

Are there any realties tests or criterias that prove the security of the PRNG? What kind of tests or criteria?
NiceTheo's user avatar
  • 591
52 votes
6 answers
18k views

Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
D.W.'s user avatar
  • 36.5k
14 votes
1 answer
2k views

What issues are there while using Linux's /dev/urandom for generating cryptographic keys?

As of Linux 5.1 the /dev/random no longer uses the blocking pool. There is a talk about the change on the page Removing the Linux /dev/random blocking pool I ...
kelalaka's user avatar
  • 49.1k
12 votes
2 answers
10k views

Using a Hash as a secure PRNG

I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I ...
cooky451's user avatar
  • 345
8 votes
2 answers
14k views

How to find generator $g$ in a cyclic group?

As generator $g$ is used in DH how do you find a combination of prime $p$ and $g$? eg: if we choose $p=23$ and its generator is $7$ (given in the book) how do we find the generator?
user7447's user avatar
6 votes
1 answer
2k views

Hash functions to generate a one-time pad

Maybe this is a newbie question: Stream cypher, will XOR message bits with one-time pad bits. Suppose I have a pseudorandom number generator, like a Mersenne Twister or something similar. I could use ...
9F48's user avatar
  • 153
86 votes
11 answers
11k views

Is modern encryption needlessly complicated?

RSA, DES, AES, etc., all use (relatively) complicated mathematics to encrypt some message with some key. For each of these methods, there have been several documented vulnerabilities found over the ...
Ozzah's user avatar
  • 977
11 votes
2 answers
1k views

Definition of a CSPRNG

I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ...
Dave White's user avatar
7 votes
1 answer
466 views

Why does entropy halve during its extraction?

It is common to use cryptographic hash functions to extract randomness from entropy sources. One of the quantitative criteria for this is that if 2n bits of entropy are put through a hash, n bits of ...
Paul Uszak's user avatar
  • 15.6k
6 votes
1 answer
12k views

How to determine the next number from java's Random method [closed]

I understand a little how Java's Random class works. I have two random numbers output from calls to nextInt() from a ...
jim's user avatar
  • 163
26 votes
4 answers
7k views

How Brittle Are LCG-Cracking Techniques?

There are published techniques for cracking LCGs, but to my eye those techniques seem very brittle — very minor changes can add nonlinearity that renders techniques like the LLL algorithm unusable. ...
Charphacy's user avatar
  • 546
14 votes
1 answer
4k views

Mixing Entropy Sources by XOR?

Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG). Can I mix them ...
David's user avatar
  • 334
12 votes
1 answer
3k views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
Blaze's user avatar
  • 551
10 votes
2 answers
10k views

Estimating bits of entropy

I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What I'm having a hard time finding is any particular literature ...
Blaze's user avatar
  • 551
9 votes
1 answer
9k views

LFSR get output from characteristic polynomial?

Say you have a characteristic polynomial of an LFSR: $$f(X) = X^4 + X^3 + 1$$ How can I use this function f to get the output of the LFSR, given some initial state? Obviously I can create the LFSR ...
AttributedTensorField's user avatar
5 votes
1 answer
784 views

The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D

The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
kelalaka's user avatar
  • 49.1k
5 votes
2 answers
707 views

What is the relationship between entropy conditioning and final output bias in a TRNG?

This question concerns the conditioning and output of true random number generators. It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It ...
Paul Uszak's user avatar
  • 15.6k
4 votes
5 answers
3k views

How to roll my own hardware RNG?

I am considering building a hardware RNG myself using cheap parts. Is this a good idea and safe enough? Random sources: amplified Zener noise from one randomly chosen ...
Maxthon Chan's user avatar
4 votes
1 answer
2k views

Generating a cryptographically secure, many-time use, symmetric encryption key

I need to generate a 256 bit encryption key described by the adjectives in the title. Currently I intend to create the key using this RNG. Is this a secure manner of creating the key, given that it ...
crawfish's user avatar
  • 483
3 votes
3 answers
1k views

Is there a floating point CSPRNG?

Is there a floating-point CSPRNG that operates, natively, using floating point operations? Looking for a CSPRNG that's very fast on GPUs, and would be hard for a CPU to beat. EDIT: Floating point ...
Erik Aronesty's user avatar
2 votes
2 answers
628 views

How to calculate the bias of cryptographic hash output from biased input?

Assume that I have a hardware entropy source. Not a TRNG, but the source that might feed a TRNG's extraction algorithm. This source produces independent bits with a not unreasonable bias of $60/40$. ...
Paul Uszak's user avatar
  • 15.6k
42 votes
6 answers
22k views

What does it mean for a random number generator to be cryptographically secure?

I've never heard a good answer. I'd like to hear details about: What are the criteria that make an RNG cryptographically secure? Why must your RNG be cryptographically secure? I.e., what are the ...
agotsis's user avatar
  • 547
39 votes
1 answer
31k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
DeepSpace101's user avatar
  • 1,717
35 votes
8 answers
13k views

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

I'm not even sure if they are serious, but I've heard many times that some people refuse to not only trust their computer to generate a random string (which is understandable) but also don't trust ...
K. B.'s user avatar
  • 383
26 votes
1 answer
19k views

Is openssl rand command cryptographically secure?

I'm wondering if the openssl rand command produces cryptographically secure random bytes. For example when in need for a random password or token: ...
firefexx's user avatar
  • 417
17 votes
1 answer
5k views

Can a LFSR be cryptographically secure?

I have been looking at an embedded microcontroller which has a cryptographic hardware engine (in particular the PIC32MZ family). These devices have what they advertise as a cryptographically secure ...
Duncan Drennan's user avatar
17 votes
8 answers
10k views

Would it be secure to use random numbers from random.org in a cryptographic solution?

Random.org provides true random numbers through an unsecured web service. Since these numbers would be transmitted in plaintext could they still be considered useful as true random numbers while ...
Jim McKeeth's user avatar
14 votes
1 answer
1k views

How random are commercial TRNGS

I'm thinking about buying a USB TRNG. How do I evaluate its randomness? I'm sure some are better than others but which is which? Are thermal-noise better than radio-noise TRNGs?
user1028028's user avatar
12 votes
1 answer
6k views

Cryptographic security of PHP mt_rand() function using Mersenne Twister algo

At StackOverflow, this question has been asked. It uses additional random entropy and a hash method (among others) to try and create a cryptographically secure pseudo-random number generator for PHP. ...
Maarten Bodewes's user avatar
  • 93.4k
11 votes
3 answers
5k views

How to evaluate chi squared result?

I've been recently working on a (supposedly) TRNG. I'm still at the beginning of the project, so it is certainly not cryptographically secure yet, for now I'm just playing around. In fact, I've ...
valerio_new's user avatar
11 votes
1 answer
7k views

Correct way to map random number to defined range?

Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX. What is the best way to map this random number to a ...
AndroidSec's user avatar
11 votes
5 answers
4k views

Radioactive Decay, Gaussian or Uniform?

I'm trying to understand the nature of true randomness. I'm building an RNG using a radioactive source. Basically, I'm measuring the time between consecutive decays which in theory should be ...
rdkylp's user avatar
  • 111
10 votes
1 answer
1k views

How distinct are the meanings of the terms "CSPRNG," "DRBG" and "stream cipher"?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher This ...
Luis Casillas's user avatar
6 votes
4 answers
640 views

A source of randomness that anyone can independently, conveniently and robustly access?

Does there exist a source of randomness that anyone in the world can independently, conveniently and robustly access? For example, the 10th decimal place of the temperature in Mexico City is ...
chausies's user avatar
  • 335
5 votes
3 answers
389 views

How to combine $n$ 'less random' bits to generate one 'more random' bit?

Suppose we have a random number generator badrand() generating 1 with probability $0.9$ and 0...
Ritesh Singh's user avatar
5 votes
2 answers
712 views

Entropy Requirements for Encryption

Quality of RNGs is an important issue. As a very basic question I would like to understand, how "poor" entropy of a RNG can help an attacker to find out the whole secret. In my naive view, even is ...
MichaelW's user avatar
  • 1,497
4 votes
1 answer
280 views

What is the NIST recommended maximum bias for random number generators?

What is the maximum bias recommended by NIST for random number generators? This answer says that it is $2^{-64}$. Is it same for all applications? Does NIST have a publication with more information? I ...
Ritesh Singh's user avatar
3 votes
1 answer
565 views

Enumerating the bias of NIST and Pearson randomness extractors

The following is an extract from a paper about using your mobile phone as a true random number generator (TRNG). The mobile phone bit is incidental to this question though. I'm interested in the ...
Paul Uszak's user avatar
  • 15.6k
20 votes
2 answers
6k views

What stops the Multiply-With-Carry RNG from being a Cryptographically Secure PRNG?

Despite the fact that Marsaglia's MWC PRNG (multiply-with-carry random number generator) is considered to be "the mother of all RNGs", it does not seem to be considered to be a CSPRNG (...
e-sushi's user avatar
  • 18k
15 votes
4 answers
2k views

Properties of PRNG / Hashes?

There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications. So, I was wondering how ...
bitmask's user avatar
  • 293
14 votes
3 answers
3k views

Entropy of two concatenated random values

In this Intel blog posting, the author claims: The amount of work required to brute-force predict a random value that has n bits of entropy is $O(2^n)$. If you concatenate two values together, the ...
user13741's user avatar
  • 2,627
13 votes
2 answers
4k views

Uniformly distributed secure floating point numbers in [0,1)

Is there any way to generate cryptographically secure uniformly distributed floating point numbers in the interval [0,1)? For example, in Javascript, there is ...
serv-inc's user avatar
  • 241