# Tag Info

110

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of Entropy. Try to win! So we don't rely on whether generating a random number from the mind or random keyboard typings and mouse movements that seem like a monkey ...

38

What are the criteria that make an RNG cryptographically secure? In short, a DRBG [deterministic random bit generator] is formally considered computationally secure if a computationally-limited attacker has no advantage in distinguishing it from a truly random source. What does this mean? Given a DRBG F and a truly random oracle G, let A be a probabilistic ...

35

The ISO/IEC 9899:1990 edition of the C standard contains: EXAMPLE     The following functions define a portable implementation of rand and srand. static unsigned long int next = 1; int rand(void) // RAND_MAX assumed to be 32767 { next = next * 1103515245 + 12345; return (unsigned int)(next/65536) % 32768; } void srand(unsigned int ...

32

A colleague of mine told me about a website that, given a sufficient quantity of output from an PRNG, had been able to deduce which application the PRNG was from. As you correctly identified this would present an immediate and probably devastating attack to any cryptographic PRNG as it indeed would allow you to easily distinguish a random string from a PRNG ...

31

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology going on that may cause people to be less random than they are intending to be (Wikipedia links to a paper claiming humans are in fact bad at this). Or perhaps ...

28

One tool that tries to do this is untwister. It's almost certainly not the tool you were thinking of, though, as it cannot determine if the output came from OpenSSL specifically. It can determine Glibc's rand(), Mersenne Twister (MT19937), PHP's MT-variant (php_mt_rand), Ruby's MT-variant DEFAULT::rand(), and Java's Random() class, though, and can recover ...

22

A one-time pad requires a true random sequence that is as long as the material you want to encrypt. If you have a pseudo-random sequence, then you don't have a one-time pad: you have a stream cipher. If you have a stream of data that is only “nearly random”, then you don't have a one-time pad, you have a broken stream cipher. Concretely, if the nearly-...

21

I have the first 40 numbers of the sequence. Is there a way to recover the seed or find the next 460 numbers in the sequence? The first thing to know is that Python's random module uses Mersenne Twister as the PRNG. That is not a cryptographically secure RNG, in fact it is easy to recover the state as long as you have enough samples. 40 numbers of the ...

21

The other answers provide very good lists of reasons not to use Twitter as an entropy source. What follows is the flip side of your question:- Why would you want to? Tweets are typically read on tablets, PCs and phones. All of those have access to hardware entropy sources that can produce oodles of truly random bits for seeding anything. The zeitgeist is ...

20

What you are suggesting is not a good idea for a general purpose random number generator. It could be meaningful for very specific use cases if you need a random number generator whose output can be verified independently by a third party. Even in those cases there are other sources of entropy which are potentially more suitable. The oldest mention of this ...

18

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. If you ask humans to generate a random sequence, they will probably pay attention not to use the same character in a row, i.e., aa or bb, as they think that ab ...

17

The answer is given by Henrick is good, but I try to give a explanation with more details in security area. When you think about PRF (Pseudo Random Function), you will think that there are three elements with PRF, which are $K, X$, and $Y$. $K$ is the keyspace, $X$ the message or input space and $Y$ the output space. PRF is a function, when you give this ...

17

I tried to use mostly non-jargon to make it more understandable than the current top answer. What are the criteria that make an RNG cryptographically secure? From en.wikipedia.org/wiki/CSPRNG: Given all outputs so far, there must not be any algorithm that predicts future outputs with anything better than guessing. If you can say "there is a 50.0001% ...

15

Python uses a Mersenne twister PRNG, and though it is not secure it does have a large state. You have here 40 numbers, the first one gives you 1 bit and each subsequent number has an extra bit for a total of 800 bits. This is significantly smaller then the internal state of the MT-19937. This page explains how to find the internal state of python's PRNG: ...

15

How are you going to decide which tweet to use? Randomly? This quickly leads to a chicken / egg problem. What if the chosen tweet is one word? That would not add a lot of entropy. What if twitter is unavailable? Are you just stopping your service that relies on the entropy or are you going to continue regardless? How are you going to keep the chosen tweet ...

15

Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess." Your sample string is hard for a human to guess, but it isn't very random. There is a tool called "ent" for most Unix systems that can quantify the randomness, by some measures, of a file. Available here: https://...

14

Notations: $v=u\bmod m$ means $m$ divides $u-v$ and $0\le v<m$, including if $u<0$. All variables are non-negative integers (except for the above). $a=214013$, $b=2531011$ are the LCG parameters. $X_n$ is the 31-bit state with $X_{n+1}=(a\cdot X_n+b)\bmod 2^{31}$. $R_n=\lfloor X_n/2^{16}\rfloor$ is the 15-bit output. $S_n=X_n-2^{16}\cdot R_n$ is the ...

14

No, that would not be a true RNG, because these physics engines would just repeat the exact same calculation and thus repeat the whole sequence of random numbers - like a PRNG. The starting conditions are the seed of this PRNG. Dice are truly random in the real world. Well, are they? If we ignore quantum effects, we could measure all relevant values of the ...

14

On modern CPUs, a fast Cryptographically Secure Pseudo-Random Number Generator runs sizably faster than one cycle per byte. We are talking >40Gbit/s. See numbers there. Top contenders are AES-CTR assisted by special instructions, and ARX ciphers like ChaCha. When using dedicated hardware, the true limit is moving around the generated random bits. We can ...

14

People are not that bad, but we're slow. See How were one-time pads and keys historically generated? In summary, MB's of 100% secure key material were generated for one time pads by people simply key smashing on type writers. Sufficient to win three world wars. It's just that a human's entropy rate is a little lower than a laser phase based TRNG. ...

13

The problem with questions that ask for “the fastest” is, that such questions always raise the counter-question: compared to what exactly? Also, your question doesn’t specify if you mean cryptographically secure physical random number generators, or any physical random number generator. Anyway… 400 Mbps doesn’t really come anywhere near the word “fastest”. ...

13

I once played this online game, it was an old-school MUD. You log in, chat, kill some goblins. It had a casino. You go into the casino and you bet X gold, and there was a 40% chance you win double your bet. Obviously in the long run, the casino will always win, right? But here's the thing. I knew the game was written in C++, and I knew the rand() ...

13

There is a black-box separation between one-way functions and collision resistant hash functions. This was proven at Eurocrypt 1998 by Dan Simon, in the paper entitled Finding collisions on a one-way street: Can secure hash functions be based on general assumptions?. Of course, this doesn't mean that it's not possible using non-black-box reductions, but no ...

12

The seed of a pseudorandom number generator — whether cryptographically secure of not — is the initial input that defines the pseudorandom sequence of outputs generated from it. It's not really a term that's specific to cryptography, except insofar as there's a considerable amount of overlap between pseudorandom number generation and cryptography, which ...

11

I am the designer of the random number generator that is behind the Intel RdRand instruction. How feasible is it that the chip's manufacturer can predict the output of this PRNG when it passed tests from the people applying the use of this RdRand instruction in kernels? It isn't. We cannot. It passes the tests because it is a cryptographically ...

11

...wouldn't key still get repeated every few hours or so - i.e. you come to the end of the PRG(K)... This is where you are mistaken. Modern cryptographic PRGs simply do no repeat within any conceivable time frame. That is, starting from a seed, a well-constructed PRG (and this is true even when they are not so well constructed, like RC4) will simply never "...

11

A TRNG is never used instead of a CSPRNG. They serve different purposes. A TRNG is used to seed a CSPRNG. A CSPRNG alone isn't enough to generate random data since it's reproducible. A hardware entropy source alone isn't enough to generate random data because all entropy sources have biases. For any purpose that's related to security or cryptography, a ...

11

No, it doesn't need a random nonce. Yes, if you use an incrementing counter, that works. As the RFC says, the only requirement is uniqueness; as long as you make sure that each nonce you use is different, you have met the requirements - an incrementing counter does that quite nicely (and, in fact, is commonly used in practice)

10

Please bear in mind that this information is all secondhand. I have not looked closely at the original drafts of Hash DRBG (although you might find a draft that's early enough if you peruse the FOIA results in [1]). However, during conversations with folks at NIST I was told that there were certain weaknesses in early drafts of Hash DRBG that were very ...

10

Trying to distinguish a synchronous stream cipher from a CSPRNG seems to me a bit like trying to distinguish ice from frozen water. Any secure stream cipher is a CSPRNG, and any CSPRNG can be used as a stream cipher. Insofar as there is any difference, it mostly comes down to intended purpose and API design. A typical CSPRNG API might take an initial seed ...

Only top voted, non community-wiki answers of a minimum length are eligible