2022 Developer Survey is open! Take survey.
8 votes

Shannon confusion and diffusion concept

I think that you missed a pivotal point in the concept, which is the small blocks that are used to compose a secure PRF (or PRP), i.e. when you permute one bit, you actually change the value of the ...
user avatar
  • 2,010
8 votes

Statistical Tests for Pseudorandom Functions

Nobody uses generic statistical tests to verify correctness of encryption algorithms. To verify correctness of an implementation, engineers write proofs of correctness for their code, tr running it ...
user avatar
7 votes

Why calculate pi to estimate randomness?

Knowledgeable crypto practitioners do not calculate $\pi$ using a Monte Carlo method to determine if a series of numbers are random. The test alluded to in the question is a general-purpose¹ ...
user avatar
  • 122k
7 votes
Accepted

Is there are a metric based on collisions to compare bad hash functions?

There are a few standard quantities related to families of hash functions $H_k\colon \{0,1\}^m \to \{0,1\}^h$ for a uniform random key $k$. You might call them metrics. They came to prominence in ...
user avatar
7 votes

Randomness Testing

There is no such thing as randomness of a sequence (or of a permutation, or of a string, etc.). There is only randomness of a process for choosing sequences (permutations, strings, etc.), which is ...
user avatar
7 votes

Which test suit is better to say if PRNG is CSPRNG:TestU01 or NIST?

Please don't. TestU01 or NIST? Neither. Trust what they say on the xoshiro256+ website. A CSPRNG is not defined by it's speed. It's defined by security against ...
user avatar
  • 13.8k
6 votes

Shannon confusion and diffusion concept

I find the terms "confusion" and "diffusion" to be slightly nebulous and can lead to over-simplifications. Confusion For example, saying that "substitution" is responsible for "confusion" is not ...
user avatar
  • 19.2k
6 votes

Plaintext for randomness evaluation of cryptographic algorithms?

If I understand you properly, you are going to test some cryptographical primitives by running them on some plaintext, and then taking the resulting ciphertext and giving it to a randomness test suite;...
user avatar
  • 131k
6 votes
Accepted

Estimated entropy per bit given P-value of a statistical test, and number of bits tested?

Firstly, the way (if at all) the "$P$-value" depends on $H$ depends (of course) on the statistical test that is being used. For each test, the result will be different and I cannot really give a ...
user avatar
  • 1,776
5 votes
Accepted

Quality test for an hardware source of randomness

NIST has a statistical test suite for testing (pseudo) random number generators. There are a number of other suites as well, such as Diehard, Dieharder, and TestU01. But all these tests can do is ...
user avatar
5 votes
Accepted

Randomness test question from FIPS 140-1 and comparison with 140-2

Q1: Why are these tests stroked out? These tests are stroked out on pages 57-58 of the current FIPS 140-2 because they are no longer part of the current FIPS 140-2 standard, since Change ...
user avatar
  • 122k
5 votes

How to prove the security of the PRNG?

How to prove the security of the PRNG? My best advice would be to start with a statistical test suite like the one NIST describes in "A Statistical Test Suite for Random and Pseudorandom Number ...
user avatar
  • 17.4k
5 votes

Given $n$ bits, how many "truly random" sequences/numbers can be constructed?

I'm not certain but aren't there ways to evaluate a given sequence as random with some given satisfied error? Given n bits, how many "truly random" sequences/numbers can be constructed? If you define ...
user avatar
  • 1,089
5 votes
Accepted

Is it possible to test 15-bit PRNG with the library TestU01?

It can be taken groups of 32 samples of 15 bits, and turned each into 15 samples of 32 bits, either by transposition, or concatenation then splitting. The best of the two method depends on the nature ...
user avatar
  • 122k
5 votes

Tests to distinguish between PRNG and a CSPRNG

What are the tests which a regular PRNG would fail but a CSPRNG would succeed? The goal of a PRNG, and the duty of a CSPRNG, is to have an output that can't be distinguished from true randomness (...
user avatar
  • 122k
4 votes
Accepted

Is the RC4 keystream random or not?

Like fkraiem's answer points out, passing a statistical test does not prove a PRNG is cryptographically random, or even statistically random with regard to other tests. In the case of RC4 the biases ...
user avatar
  • 31.2k
4 votes

Is the RC4 keystream random or not?

Statistical tests have no value to evaluate randomness in a cryptographic sense, because an attacker is not required to use any specific test. The fact that a stream passes some set of predetermined ...
user avatar
  • 7,904
4 votes

Minimum number of independent trials needed to detect a bias

I searched the web, and finally (I think) I got: In page 47, 48 of this thesis, it is mentioned that - To detect a bias of $p(1+q)$ (where $p$ is the probability for an Uniform Random event), we ...
user avatar
  • 593
4 votes

How can I calculate non-linearity of an s-box element wise?

I'm not sure if I fully understand your question. "tell me how to trasform the s-box which is in binary form into decimal form?": Changing numbers between binary and hexadecimal (or decimal,...
user avatar
  • 126
4 votes

Is it correct to concatenate (pseudo-)random byte values before testing them with the NIST suite or tools like dieharder?

Is it valid to just concatenate the thousands of 4-byte values so that I end up with one very long byte (n * 1000 * 4 byte) stream which I then feed into these tools? Is it correct that it doesn't ...
user avatar
  • 122k
4 votes

Is it correct to concatenate (pseudo-)random byte values before testing them with the NIST suite or tools like dieharder?

Thousands of bytes isn't nearly enough samples for any powerful statistical test. The fewer samples you have the less sensitive a given test can be. If you concatenate statistically independent ...
user avatar
4 votes

How to compute the dataset size required by dieharder tests?

I'll be so bold as to say that no one knows for sure how much data you really need. There is no guidance on the homepage, the manpage and this thread from Duke is equally unspecific. Anecdotal ...
user avatar
  • 13.8k
4 votes
Accepted

How many $k$-bit words of a random bitstring are we expected to extract before all $2^k$ possible words occur?

This known as the coupon collector's problem, with the number of coupons replaced by $2^k$ and $k$ is the number of independent bits drawn ($k=4$ in the question's example). It's expected $(k\log(2)+\...
user avatar
  • 122k
3 votes
Accepted

How do you interpret the p-values from the Dieharder testsuite to evaluate an RNG?

I've read that a good RNG will have a range of p-values that follows a uniform distribution; values between 0 and 1 should happen with about equal probability. Why should that be so? It comes ...
user avatar
  • 31.2k
3 votes
Accepted

What problems with "random" data would cause this result from Ent?

I've seen this before in the true random number generators I've been working on. Look at the following test. I've ent'd two jpegs, one 10 times the size of the other. A jpg is highly compressed so ...
user avatar
  • 13.8k
3 votes
Accepted

Is my implementation of a PRG at least intuitively secure?

PRNGs are a difficult and hot topic. Some tests can be found here: What tests can I do to ensure my PRNG is working correctly? But they do not tell you (or others) if your PRNG is really secure. A ...
user avatar
  • 768
3 votes

Given $n$ bits, how many "truly random" sequences/numbers can be constructed?

The short answer is: given $n$ bits, $2^n$ “truly random” $n$-bit sequences can be constructed — all of them. Randomness is not a property of a number, nor a property of a sequence of numbers. It's a ...
user avatar
3 votes

Statistical tests for pseudorandom permutations

Typically, the output of format-preserving encryption is easily distinguishable from a random bitstream, precisely because the ciphertexts conform to some non-random format. Thus, you cannot use ...
user avatar
3 votes

Interpretation of (NIST) Non Overlapping Template Matching Test

First, Fisher's method is a way to combine several independent statistical tests with known distributions under the null hypothesis into a single statistical test with a known distribution under the ...
user avatar
3 votes

Golomb's Randomness postulates

They make sense as a starting point, for pseudorandomness. R1. This is a strict balancedness condition, the difference is 1, in case $N$ is odd and zero is impossible. R2. If you have an i.i.d. and ...
user avatar
  • 16.1k

Only top scored, non community-wiki answers of a minimum length are eligible