# Questions tagged [randomness]

Usage of randomness (i.e. non-predictable data, usually in the form of bits or numbers) for cryptographic purposes.

62 questions
Filter by
Sorted by
Tagged with
23k views

### What is the difference between CSPRNG and PRNG?

What is the difference between CSPRNG and PRNG? Is there performance differential between them? For example: We use PRNG for key generation which is very expensive and CSPRNG for IV/nonce in block ...
1k views

### How random is the shared secret in the Diffie Hellman key agreement

How random is the value $ZZ$ in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
10k views

### Is modern encryption needlessly complicated?

RSA, DES, AES, etc., all use (relatively) complicated mathematics to encrypt some message with some key. For each of these methods, there have been several documented vulnerabilities found over the ...
26k views

### What is entropy?

We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
3k views

### How to evaluate chi squared result?

I've been recently working on a (supposedly) TRNG. I'm still at the beginning of the project, so it is certainly not cryptographically secure yet, for now I'm just playing around. In fact, I've ...
5k views

### What is the use of REAL random number generators in cryptography?

I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators. However, I don't understand for what a real random number ...
649 views

### Can we exchange the permutation of a sponge construction?

Part of a sponge construction (like SHA3 uses) is a fixed permutation $p$; which is clearly not one-way. Could we, theoretically, exchange the permutation $p$ with any other permutation? What basic ...
2k views

### Why use randomness in digital signature algorithms?

I understand why randomness has to be employed in encryption, because deterministic ciphers are not IND-CPA. I don't understand why digital signature schemes that employ randomness, like RSA-PSS, are ...
3k views

### How exactly is “true randomness” defined in the realms of cryptography?

Especially in relation to stream ciphers, I frequently read about (sometimes theoretical, sometimes practical) attacks that are able to "distinguish a ciphertext from a truly random stream". What's ...
1k views

### How random are commercial TRNGS

I'm thinking about buying a USB TRNG. How do I evaluate its randomness? I'm sure some are better than others but which is which? Are thermal-noise better than radio-noise TRNGs?
1k views

### Why in one time pad must the key distribution to be truly random

One time pad required a truly random key. Why canwt it be a psudo-random key? For example, if the key distribution is that for each bit the probability to get 1 is 0.6 and the probability to get 0 is ...
11k views

### What does it mean for a random number generator to be cryptographically secure?

I've never heard a good answer. I'd like to hear details about: What are the criteria that make an RNG cryptographically secure? Why must your RNG be cryptographically secure? I.e., what are the ...
481 views

### Discrete Gaussian Sampling role in Lattice-Based Crypto?

I'm reading up on how post-quantum cryptography works, and stumbled upon the notion of discrete Gaussian sampling. However, I can't understand where it fits in the greater picture - currently it feels ...
518 views

### Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?

It is knowns that SHA-1 has been broken in practice using collision attacks. Related to SHA-1 this mainly had a negative impact on the security of Digital Certificate signatures Email PGP/GPG ...
8k views

244 views

### Sub exponentially hard OWF , PRF and iO

I'm currently reading the work "Obfuscation of probabilistic circuits and Applications' by Canetti Lin Tessaro and Vaikuntanathan 2015. It says sub exponentially hard OWF implies sub exponentially ...
169 views

### In a specific Paillier implementation, why is r prime?

I have a question about an implementation of the Paillier cryptosystem. In the description of Paillier above, encryption of a plaintext message $m$ on $\mathbb {Z}_{n^{2}}$, $0\leq m<n$, proceeds ...
3k views

### Are mouse movement coordinates useful as a seed for a RNG?

Is it good to use a mouse movement as a 64-bit random seed for a Pseudorandom Generator like AES in Counter Mode? Should I only need to get the X and Y coordinates of the mouse movement?
1k views

### Is LUKS Anti-Forensic information splitter (AFsplit) indistinguishable from random data?

I want to know if AFsplit(random_data_input, stripes, digestmod=sha) output is indistinguishable from random data. The attacker ...
555 views

### Is this truly a TRNG?

As an appendix for my bachelor thesis, I proposed a solution for a TRNG that uses JPEG images as entropy source. It's open source and available on GitHub. My question is: can this be really ...
1k views

### Impact of the hash algorithm on a PRNG

Pseudorandom number generators often use hash functions for the generation. Some applications allow the users to choose this hash function, for example OpenVPN. From the OpenVPN manual: --prng alg ...
2k views

### Where do key generation algorithms take the randomness from?

I was just wondering, because in many encryption tools like Veracrypt or GnuPG you have to generate pseudo randomness with your mouse movement. So, where do automatically generated keys take that ...
190 views

### How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...
In the basic ElGamal encryption scheme, we encrypt a message $m$ as $(g^r, h^r m)$, where $g$ is the group generator and $h$ is the public key of the recipient. If the sender has another message $m'$ ...