3 ms·

Disclaimer: My pet programming language has PCG as one of its available RNGs. It also has xorshift. PCG doesn't have many downsides, and indeed is slowly but s

Disclaimer: My pet programming language has PCG as one of its available RNGs. It also has xorshift. PCG doesn't have many downsides, and indeed is slowly but surely outcompeting the other hashes in the fast general RNG niche, like MT, xoroshiro, and xorshift. Your "label them both green" complaint is misleading. The descriptive word "Challenging" is used to describe PCG, while "Secure" is used to describe the CSPRNGs. In this context, it's pretty easy to understand that the "Secure" in the description is the same as the "Secure" in "CSPRNG". The author admits in the PCG paper [0] that PCG isn't meant to stand up to cryptographic scrutiny and that it hasn't been reviewed as such, while also demonstrating that, by construction, the predictability of PCG is pretty challenging, especially compared to some other RNGs still in popular use! From NetBSD's man page on arc4random: "There is no way to get deterministic, reproducible results out of arc4random for testing purposes." Other implementations of arc4random don't have the ability to control the initial entropy. Ultimately, as far as whether or not the code is simpler or faster than MT, you can judge for yourself [1]. It is not a hard read. [0] http://www.pcg-random.org/paper.html http://www.pcg-random.org/paper.html [1] http://www.pcg-random.org/download.html http://www.pcg-random.org/download.html

lucb1e 8y ago
> The descriptive word "Challenging" is used to describe PCG, while "Secure" is used to describe the CSPRNGs. In this context, it's pretty easy to understand that the "Secure" in the description is the same as the "Secure" in "CSPRNG". I would say that the same color should mean that it is of equal value. In this case, even after comparing the chosen descriptive words, it was not clear to me that this was not supposed to be a CSPRNG. It seemed so, but it could have been that it's just too new to make such a claim, or perhaps that an attack was found. The information is there when you look for it, but it's not obvious from this first impression. I see where you're coming from, but I was not trying to be misleading. I think it's genuinely confusing for someone who knows what a CSPRNG is (me), let alone the average developer who wants to generate private keys fast and finds this. Edit: and then there's this, as pointed out in another comment: http://pcg.di.unimi.it/pcg.php#false http://pcg.di.unimi.it/pcg.php#false Apparently it can be predicted with only 3 outputs. If memory serves, even good ol' MT does much better than that.
- myWindoonn 8y ago
  Vigna's points are addressed by PCG's author directly here: http://www.pcg-random.org/posts/on-vignas-pcg-critique.html http://www.pcg-random.org/posts/on-vignas-pcg-critique.html
  - tptacek 8y ago
    I don't know about the rest of it, but the section of this response about prediction difficulty is word salad, and it's pretty amusing that the "pcg32 is annoying to predict" claim is backed by a proof of concept of a paper from 1988 (it is approximately "problem on an academic CTF" hard; someone should do that challenge, since I feel like people are always looking for straightforward-but-plausible applications of LLL on these things). Vigna didn't claim to have designed an RNG that was difficult to predict. But the PCG author did.
- rurban 8y ago
  Vigna starts with a bullshit argument. You can likewise decrypt ssh if you know the secret key. On the other hand vigna's (and therefore linux) RNG's are easily predictable without knowing the internal state, but just by observing the external output for some short time.
  - whyever 8y ago
    > On the other hand vigna's (and therefore linux) RNG's are easily predictable without knowing the internal state, but just by observing the external output for some short time. They are not CSPRNGs, so it is expected that they are predictable. I don't think anyone claimed the contrary.
    - rurban 8y ago
      But PCG is not and it is simple and fast. Its qualities are much better than vigna's. He did mostly respond with bullshit, though his other arguments are better. But not convincing still.

lucb1e 8y ago

> The descriptive word "Challenging" is used to describe PCG, while "Secure" is used to describe the CSPRNGs. In this context, it's pretty easy to understand that the "Secure" in the description is the same as the "Secure" in "CSPRNG". I would say that the same color should mean that it is of equal value. In this case, even after comparing the chosen descriptive words, it was not clear to me that this was not supposed to be a CSPRNG. It seemed so, but it could have been that it's just too new to make such a claim, or perhaps that an attack was found. The information is there when you look for it, but it's not obvious from this first impression. I see where you're coming from, but I was not trying to be misleading. I think it's genuinely confusing for someone who knows what a CSPRNG is (me), let alone the average developer who wants to generate private keys fast and finds this. Edit: and then there's this, as pointed out in another comment: http://pcg.di.unimi.it/pcg.php#false http://pcg.di.unimi.it/pcg.php#false Apparently it can be predicted with only 3 outputs. If memory serves, even good ol' MT does much better than that.

myWindoonn 8y ago
Vigna's points are addressed by PCG's author directly here: http://www.pcg-random.org/posts/on-vignas-pcg-critique.html http://www.pcg-random.org/posts/on-vignas-pcg-critique.html
- tptacek 8y ago
  I don't know about the rest of it, but the section of this response about prediction difficulty is word salad, and it's pretty amusing that the "pcg32 is annoying to predict" claim is backed by a proof of concept of a paper from 1988 (it is approximately "problem on an academic CTF" hard; someone should do that challenge, since I feel like people are always looking for straightforward-but-plausible applications of LLL on these things). Vigna didn't claim to have designed an RNG that was difficult to predict. But the PCG author did.
rurban 8y ago
Vigna starts with a bullshit argument. You can likewise decrypt ssh if you know the secret key. On the other hand vigna's (and therefore linux) RNG's are easily predictable without knowing the internal state, but just by observing the external output for some short time.
- whyever 8y ago
  > On the other hand vigna's (and therefore linux) RNG's are easily predictable without knowing the internal state, but just by observing the external output for some short time. They are not CSPRNGs, so it is expected that they are predictable. I don't think anyone claimed the contrary.
  - rurban 8y ago
    But PCG is not and it is simple and fast. Its qualities are much better than vigna's. He did mostly respond with bullshit, though his other arguments are better. But not convincing still.