Skip to main content
1 of 2
D.W.
  • 36.7k
  • 13
  • 105
  • 193

There is some relationship between the two notions, but a CSPRNG is designed to be computationally secure (secure against adversaries with bounded computation time), whereas a randomness extractor is required to be information-theoretically secure (unconditionally secure against adversaries with unbounded computation time). So, they're different primitives.

I would not expect a typical CSPRNG to be a secure randomness extractor. Typically CSPRNGs use computationally secure primitives, like AES etc.; they don't provide security against adversaries with unlimited computing power.


We can also compare randomness extractors to pseudorandom generators (PRGs), but again, they're very different. PRG's are not designed to act as a randomness extractor, so there is no reason whatsoever to expect any particular PRG to do a good job at randomness extraction. Indeed, I'd expect that many secure PRG's might be perfectly good as a PRG but no good at all as a randomness extractor. The purpose of a randomness extractor is designed to take a non-uniformly distributed seed and turn it into a uniformly distributed output. That's very different from the task that PRG's are designed for. PRG's are designed to be secure if their seed is distributed uniformly at random. There is no guarantee whatsoever that they will be secure if the seed is distributed non-uniformly, and indeed, for some secure PRG, they might be insecure when used with a non-uniformly distributed CSPRNG.


In short, if you take a CSPRNG or a PRG, I would not expect it to necessarily act as a secure randomness extractor. They're just different things.

D.W.
  • 36.7k
  • 13
  • 105
  • 193