New answers tagged

0

The short answer is that LLL (or more generally, lattice reduction methods) is useful when you can convert your problem into finding a small linear combination of known vectors. Let's take your example and make it concrete. Let $m = 2^{64}$, $a = 7244019458077122845$, $b=1$, and the we have a generator that output the upper 16 bits of the state at each ...


0

I'll use ChaCha20 as an example. It's a stream cipher, but is used as the core of the system random number generator on Linux. I'll also refer you to this excellent article about how ChaCha20 works as a stream cipher. ChaCha20 can be used as a fast key erasure CSPRNG. When a caller requests $N$ bits of random data (a single number in the sequence), it's used ...


3

what is the purpose of this line of code? while (bits - val + (n - 1) < 0); From a syntactic perspective, it ends the do opened above. From a functional perspective, it makes the pseudo-random number generated uniform on the specified interval. I'll focus on the later aspect. Assume n was $3\cdot2^{29}\,$ (that is 3<<29) rather than $6$. After the ...


2

I think Luis Casilla's answer answers the question underlying your post (and is thus quite valuable), but not exactly the question you asked. State is a concept used primarily in computer science (and not other areas of mathematics). Wikipedia offers the relevant article State (computer science) where it explains the general idea that an algorithm's output ...


3

By the definition of a cryptographically secure PRNG on Wikipedia, given part or all of the internal state, an adversary should not be able to reconstruct the prior stream of random numbers. That's an engineering specification of what requirements a practical CSPRNG should be evaluated against. The definitions used for pseudorandom generator (PRG) in ...


2

Section 2.6 of their submission talks about this. There they state that for most cases they simply use SHA-256, -384 or -512. In the (uncommon?) case that a hash function with a larger output is needed, they use the OFB-like1 construction. The rationale being that a collision on the OFB construction would immediately imply a collision on the underlying hash ...


Top 50 recent answers are included