Questions tagged [random-number-generator]

A random number generator is a software or hardware solution which functions as a generator of (real or pseudo) random numbers (or bits).

Filter by
Sorted by
Tagged with
11
votes
5answers
7k views

How does generating random numbers “remove entropy from your system”?

In a previous question, I quoted the --gen-random entry in the GPG Man Pages. At the end it says: PLEASE, don’t use this command unless you know what you are ...
11
votes
2answers
1k views

Dice vs quantum random number generator

I recently championed quantum key distribution networks. This has led me to also question quantum random number generators. It appears that randomness is randomness, even if made by custom quantum ...
11
votes
2answers
1k views

Definition of a CSPRNG

I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ...
11
votes
1answer
5k views

Correct way to map random number to defined range?

Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX. What is the best way to map this random number to a ...
11
votes
2answers
1k views

Is CPU timing jitter a usable entropy source?

In some virtualized environments, the only source of entropy available is CPU timing jitter. Can one get enough entropy from this source for practical uses? Also, is this secure against local side-...
11
votes
1answer
399 views

How to tell if a hardware RNG is rigged?

On a related note of building my own RNG, as someone suggested to use several commericial solutions how can I check if it is rigged against me? (although I am still strongly biased to a homebrew ...
10
votes
5answers
2k views

How to prove the security of the PRNG?

Are there any realties tests or criterias that prove the security of the PRNG? What kind of tests or criteria?
10
votes
3answers
6k views

How to generate a list of unique random strings?

How would you generate a list of distinct random strings, where all strings are alphanumeric and have a fixed length?
10
votes
3answers
4k views

Is a die implemented in a physics engine truly random?

So, a fair die throw is really random, not pseudo. So, would a RNG implemented as the result of a die throw in a physics engine (say, Newton, Havok, Nvidia's PhysX) be regarded as both ...
10
votes
3answers
2k views

HRNG for One Time Pad

I have just advanced to the last grade of high school (in Denmark). In this year, we all get to do one big project, where we can build/invent/create whatever we want to "solve a problem". As I study ...
10
votes
2answers
1k views

Does an encrypted random sequence conserve its “randomness”?

If you have a random uniform sequence of bits $A$ generated by a TRNG with good performance of randomness tests (eg Dieharder, NIST, Kolmogorov complexity, chi-square, etc) and perform an encryption (...
10
votes
3answers
7k views

Estimating bits of entropy

I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What I'm having a hard time finding is any particular literature ...
10
votes
1answer
3k views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
10
votes
3answers
13k views

How vulnerable is the C rand() in public cryptography protocols?

I just learned about the basics of public cryptography a few weeks ago and I am curious as to why the C rand() function should not be used for crypto schemes. For example, say I want to generate a ...
10
votes
2answers
7k views

Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD Yarrow,...
10
votes
1answer
986 views

Distributed generation of random numbers

I have a network of $N \gg 1$ nodes. Some relatively low fraction $p$ (e.g., $p \simeq 0.01$) of them is under the control of a malicious attacker. Nodes can talk to each others and verify each other'...
10
votes
1answer
1k views

What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?

Given a binary shift register of $n$ bits, a primitive binary nonlinear feedback shift register will generate a sequence with a period of $2^n - 1$. While I am unable to find a paper which directly ...
10
votes
2answers
1k views

Shared secret: Generating Random Permutation

-- or: How to Play Poker Without a Dealer I know this question is long but it's a really interesting theoretical problem about shared secrets and multi-party computation. General Problem: "Shared ...
10
votes
0answers
531 views

What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistel ...
9
votes
1answer
6k views

Generating Random Primes

Although this has been extensively discussed around here, I'm curious whether my approach makes sense, or I should just stick to "the standard version". I'm implementing some homomorphic encryption ...
9
votes
4answers
3k views

Predicting PRNG given some of its previous output

I a have a question about PRNGs and this is my very first experience with them. I have the following generator that takes a 56-bit seed $p$ during initialization and then chooses both $X$ and $Y$ ...
9
votes
2answers
3k views

Does Microsoft use Dual_EC_DRBG by default?

So, as we all know, Dual_EC_DRBG contains an NSA back door. At this point, there is no reason to call it a "potential" or even an "alleged" back door; the presence is obvious even to the NY Times. As ...
9
votes
1answer
2k views

“Seed” vs “seed key”

The FIPS 140-2 Derived Test Requirements has a statement: AS07.09: (Levels 1, 2, 3, and 4) The seed and seed key shall not have the same value. What is the difference between a seed and a "seed ...
9
votes
3answers
327 views

Does chaining random number generators lead to loss of randomness?

Assume you chain random number generators, i.e use the result of one PRNG as the seed for the next. What kind of errors can that introduce in the randomness of the numbers generated?
9
votes
1answer
530 views

Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

The fastest known attack against the Salsa20 family of stream ciphers requires 2137 simple operations against Salsa20/7, or 2244 against Salsa20/8. The 8-round version encrypts data at 1.88 cycles-per-...
9
votes
2answers
1k views

How do you test randomness?

Suppose I receive a list of 1 million coinflips, and I want to know how likely it is that the list was randomly generated. My first thought would be to count the number of heads and tails, which ...
9
votes
1answer
3k views

What should be used as a source for entropy?

I have hardware-based RNG which consists of TRNG and PRNG. TRNG is giving out a 512-bit number which is being used as a seed for PRNG. RNG is generating a 160-bit random number using PRNG and ...
9
votes
3answers
540 views

Is it possible to determine or estimate the period for Blum-Micali PRG?

The Blum-Micali is a cryptographically secure pseudorandom number generator. The construction (from wikipedia): Let $p$ be an odd prime, and let $g$ be a primitive root modulo $p$. Let $x_0$ be a ...
8
votes
11answers
4k views

Algorithm: How to use x and y mouse movement co-ordinates to generate random data?

Background: I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for encrypting/...
8
votes
1answer
779 views

RFC6979: error in reference implementation?

If I correctly understand RFC 6979, there is an error in the ref implementation section 3.2. In the step H2, RFC specification says ...
8
votes
2answers
986 views

How feasible would it be to generate 300 million public key pairs in 8 hours?

Assume there is a hypothetical situation where one would need to generate hundreds of millions of public key pairs of reasonable strength in a limited time. What would be required in terms of ...
8
votes
1answer
1k views

Why does BCRYPT_RNG_DUAL_EC_ALGORITHM get removed from CNG API on Windows 10?

On article at => Microsoft Docs CNG Algorithm Identifiers I notice that BCRYPT_RNG_DUAL_EC_ALGORITHM is now removed since Windows 10. Beginning with Windows ...
8
votes
3answers
587 views

Why do we require a CSPRNG's output to be indistinguishable from true random?

Everywhere I read, indistinguishability of output from true random is stated as a requirement for CSPRNGs. However nobody bothered to give the rationale for such a strong requirement. Specifically, ...
8
votes
3answers
1k views

Is there some way to generate a non-predictable random number in a decentralised network?

Is there a way to generate a random number with given restrictions: It will be used in a decentralised network with a big number of peers (no central authority to generate it) Its generation should ...
8
votes
2answers
3k views

Extracting randomness from highly-biased RNG

I have a source with a very low entropy (like 3 entropy bits per 1024 source bits). But I need to construct a 128 bit seed from the source. Will it be helpful to XOR 350 bits with jump 128 bits, e.g....
8
votes
1answer
15k views

Can Pre-Paid Cards be cracked?

Is it possible to deduce the original function that used to generate those prepaid cards number that are used for charging your mobile phone credits? For example: If I've collected about 1000 of ...
8
votes
2answers
1k views

Trial divisions before Miller-Rabin checks?

I'm trying to understand prime number generation (more correctly, the primality checking) as described in Handbook of Applied Cryptography. The context is circa pages 145 - 150, and specifically ...
8
votes
2answers
782 views

Perfect shuffle possible with limited raw entropy?

I am trying to shuffle a standard 52-card deck in a perfect way (every outcome should be possible at an equal chance). I am not, at this point, concerned with cryptanalysis attacks against it. I have ...
8
votes
3answers
2k views

Usage difference between x86 RDRAND and RDSEED

Modern x86 CPUs often have the RDRAND and RDSEED instructions for hardware generation of random numbers. I just don't understand the difference between them. Intel has this document: https://...
8
votes
3answers
1k views

Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?

I am actually looking for available crypto libraries including a deterministic random generator for the purpose of a dedicated crypto key generator unit. I have a simple question about the X9.31 based ...
8
votes
3answers
2k views

Deterministically combine more than one source of entropy

What is the proper/canonical way to do this? For example, $0 < r1 < 1$ and $0 < r2 < 1$. Presuming uniformly distributed probabilities for the two, combining/averaging them is going to ...
8
votes
3answers
1k views

Testing the Fortuna random number generator?

I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at http://www.seehuhn.de/...
8
votes
1answer
1k views

Can hash functions improve a lousy PRNG?

If I have a poor PRNG, could a cryptographically secure hash function make a better output? Say the PRNG can produce as much numbers as you wish, reasonably random, but not good enough to be used in ...
8
votes
3answers
2k views

ANSI X9.31: the purpose of the date/time vector in the PRNG?

What is the exact purpose of the date/time vector $dt$ in the ANSI X9.31 PRNG? $$ I := E_K(dt) $$ $$ R := E_K(I \oplus V_{old}) $$ $$ V_{new} := E_K(R \oplus I) $$ Specifically, the document seems ...
8
votes
1answer
508 views

How did SHA-1 'feed' Blum Blum Shub

One of the most (in)famous hardware derived random number generators was Lavarand (patent). It did it with funky lava lamps. An image of the lamps was hashed and fed into Blum Blum Shub (BBS) to ...
8
votes
1answer
708 views

How distinct are the meanings of the terms “CSPRNG,” “DRBG” and “stream cipher”?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher This ...
8
votes
1answer
1k views

Entropy estimation by Linux Kernel when adding entropy from TRNG

As per resources given below, after adding the bits to entropy pool, the Linux RNG estimates the amount of entropy for "credit_entropy_bits" function. It is estimating the amount of entropy of an ...
8
votes
5answers
1k views

Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
8
votes
2answers
2k views

Is FIPS 140-2's “Continuous random number generator test” practical?

Section 4.9.2 of FIPS PUB 140-2 specifies, amongst other things, a "Continuous random number generator test." Here are the relavant bits: If each call to a[n] RNG produces blocks of n bits (...
7
votes
3answers
1k views

Initialize a PRNG with a password

Let's assume that we have a secure PRNG. Is it "safe" to initialize it with password, or seed based on a password like SHA256(password)? If yes, is it "safe" to generate an RSA or DSA key from it? ...

1
2
3 4 5
14