New answers tagged

-2

Yes a CSPRNG does require a secret random seed. Keeping cryptographic requirements in mind OS developers have given multiple sources for fetching a good enough seed from sources of high entropy, and they may be available in the form of APIs . For example arc4random() family of functions in BSD type operating systems. If the APIs are not available, then we ...


2

Actually, your second sentence itself is the answer. A pseudo random number generator(cryptographically secure or not) is a deterministic algorithm which produce random looking numbers. Every time you provide the same seed it produces the same random looking numbers. Now, if your seed value is predictable and algorithm is public then the output of the ...


0

If the primes $p$ and $q$ are: appropriately chosen (see abstract of original paper here) and large enough (use NFS factoring complexity to determine how large they should be) then to distinguish non uniformity one basically has to factor $N=pq.$ However, as stated by @Maeher in the comments this holds only asymptotically.


28

One tool that tries to do this is untwister. It's almost certainly not the tool you were thinking of, though, as it cannot determine if the output came from OpenSSL specifically. It can determine Glibc's rand(), Mersenne Twister (MT19937), PHP's MT-variant (php_mt_rand), Ruby's MT-variant DEFAULT::rand(), and Java's Random() class, though, and can recover ...


0

For a CSPRNG, finding two seeds that generate the same sequence should be difficult as finding two strings with the same hash. Similarly if someone can find these two strings, then this CSPRNG must be deprecated, cause the entropy should be so large that the probability of finding this "collision" is negligible. Nevertheless, when you're going to use a ...


31

A colleague of mine told me about a website that, given a sufficient quantity of output from an PRNG, had been able to deduce which application the PRNG was from. As you correctly identified this would present an immediate and probably devastating attack to any cryptographic PRNG as it indeed would allow you to easily distinguish a random string from a PRNG ...


4

You can construct a discriminator which applies G' on the first half of the output in question and compares it to the second half. If they match claim it came from G'' otherwise call it random. This discriminator has no false negatives and a false positive rate of $2^{-n-2}$. The ability to build an efficient discriminator with non negligible success ...


2

You'd do well to review your readings to see if they stipulate somewhere earlier that when they say "random" they mean uniform random (equiprobable). But even without such a stipulation that I'd say the definition as you've loosely formulated it and are interpreting it seems to imply equiprobability. If we follow your logic strictly, then we have to ...


6

Define the Mutual Information of a pair of random variables. $$I(X; Y) = H(X) - H(X\mid Y)$$ For discrete random variables we hae that $H(X\mid X) = 0$, so: $$I(X; X) = H(X)$$ The Data-Procesing Inequality states that for any function $f$, we have that: $$I(f(X); f(Y)) \leq I(X; Y)$$ While we won't need it here, this includes randomized functions, provided ...


Top 50 recent answers are included