4 ms·
Yes. GP is mistaken here; this is novel work that is somewhat concerning -- mostly in how it might apply to other similarly state-based RNGs.
by hlieberman 9y ago
Yes. GP is mistaken here; this is novel work that is somewhat concerning -- mostly in how it might apply to other similarly state-based RNGs.
- pbnjay 9y agoI made no comment on the work done here, it is novel and concerning if you use the outputs for important things. My comment is that non-cryptographic random number generators should not be used for security-critical functions. These functions are specifically built for speed, not security.
- karanlyons 9y agoI wouldn’t say this work is novel in the general case of “PRNGs are not CSPRNGs”. You can throw a constraint solver at most any PRNG and given sufficient output determine the state fairly easily. As a datapoint, doing this for xoroshiro took me half an hour: https://gist.github.com/karanlyons/805dbcc9e898dbd17e06f2627d5f9111 https://gist.github.com/karanlyons/805dbcc9e898dbd17e06f2627...
- anfractuosity 9y agoHeh, that sounds cool. I'll save opening that link for later.
- karanlyons 9y agoDon’t worry, it’s safe: I didn’t put the actual solver, just proof that I solved it. Wouldn’t want to spoil the fun for anyone else :)