6 ms·

If you want to design a cryptographic RNG that falls between LCGs and PCG in speed, please have a go at it. Meanwhile we'll use our small and fast PRNGs and st

If you want to design a cryptographic RNG that falls between LCGs and PCG in speed, please have a go at it. Meanwhile we'll use our small and fast PRNGs and strive to make them as good as they can possibly be for non-cryptographic uses.

matthewdgreen 5y ago
I beg you to define what “good” means in a way that doesn’t imply security properties. And if you must demand security properties, god help you if you designed something that can’t provide them.
- 317070 5y ago
  Say I want to numerically approximate a high dimensional integral with MC sampling, say in a computational fluid dynamics simulation, or in a ray traced render. For this, I need consequent samples from a PRNG to be really uncorrelated and fast. But there is no adversary relationship, so I don't need cryptographic strength. I just cannot have any spurious correlations between samples, as they might throw off convergence speed or worse, introduce error.
- foxfluff 5y ago
  You don't need to define good in an absolute sense to see how one thing can be better than another. The flaws of an MCG or LCG are easily witnessed, so it's totally fair for someone to go find out if it's possible to do better (i.e. remove obvious patterns, fix low period of low order bits, improve statistical quality) without sacrificing much performance; and indeed perhaps making it faster than a large-state LCG of comparable quality would be. If you admit that there are any legitimate uses for non-cryptographic PRNGs then I guess a 32 bit MCG (or "42") is just perfect for you (otherwise you'd know what's better and you don't need to ask anyone to define good). You're easy to please. If you think there are no legitimate use cases for these fast generators at all, then I'm sorry but a lot of people disagree and they will never rewrite their sims, noise generators, world generators, etcetra to use a CSPRNG no matter how much you whine about it.
dogecoinbase 5y ago
Saving some weight by leaving the airbag out of your car doesn't mean that it going faster is a good thing.
- foxfluff 5y ago
  So did PCG or xoroshiro leave the airbag out of MCGs or what? Or are you one of those who pretend that there was never any legitimate use case for any non-cryptographic PRNG?
  - matthewdgreen 5y ago
    There are perfectly legitimate use case (in a tiny niche area) for non-cryptographic RNGs - however, three points: 1. Non-cryptographic RNGs, should they be incorporated in security-critical applications are dangerous. If you insist on manufacturing poisonous chemicals that look appetizing and say “Kool-Aid” on them, kids are going to drink them. And this is your damned fault. 2. Non-cryptographic RNGs should not be evaluated and improved so as to (appear to provide) security properties. Non-invertability is a security property. Anyone who needs this property probably wants something that has been properly evaluated by experts to provide it. This construction has not been, and it is appropriate to assume that against a sufficiently-motivated adversary it will not provide it. Assuming otherwise is stupid and dangerous. 3. People who can use a non-cryptographic RNG but can’t afford the compute of a full cryptographic RNG are a very small subset of all users with very specific computing limitations. If you must target them with something, you should justify your computing speedup. My proposal is that this type of non-cryptographic RNG should have a name that is not easily confused with safe cryptographic PRNGs. Perhaps “statistical sequence generator”. Moreover, people designing these systems should not be playing with security properties. Do one thing or the other, but not both things badly. The set of people who need fast statistical (but insecure) sequence generators is small. They know who they are and what they need. Stop littering the school yard with poisonous chemicals that say “Kool Aid” in an effort to reach a few hundred laboratory chemists who are perfectly capable of calling you and ordering exactly the ingredients they know they need.
    - 5y ago

matthewdgreen 5y ago

I beg you to define what “good” means in a way that doesn’t imply security properties. And if you must demand security properties, god help you if you designed something that can’t provide them.

317070 5y ago
Say I want to numerically approximate a high dimensional integral with MC sampling, say in a computational fluid dynamics simulation, or in a ray traced render. For this, I need consequent samples from a PRNG to be really uncorrelated and fast. But there is no adversary relationship, so I don't need cryptographic strength. I just cannot have any spurious correlations between samples, as they might throw off convergence speed or worse, introduce error.
foxfluff 5y ago
You don't need to define good in an absolute sense to see how one thing can be better than another. The flaws of an MCG or LCG are easily witnessed, so it's totally fair for someone to go find out if it's possible to do better (i.e. remove obvious patterns, fix low period of low order bits, improve statistical quality) without sacrificing much performance; and indeed perhaps making it faster than a large-state LCG of comparable quality would be. If you admit that there are any legitimate uses for non-cryptographic PRNGs then I guess a 32 bit MCG (or "42") is just perfect for you (otherwise you'd know what's better and you don't need to ask anyone to define good). You're easy to please. If you think there are no legitimate use cases for these fast generators at all, then I'm sorry but a lot of people disagree and they will never rewrite their sims, noise generators, world generators, etcetra to use a CSPRNG no matter how much you whine about it.

dogecoinbase 5y ago

Saving some weight by leaving the airbag out of your car doesn't mean that it going faster is a good thing.

foxfluff 5y ago
So did PCG or xoroshiro leave the airbag out of MCGs or what? Or are you one of those who pretend that there was never any legitimate use case for any non-cryptographic PRNG?
- matthewdgreen 5y ago
  There are perfectly legitimate use case (in a tiny niche area) for non-cryptographic RNGs - however, three points: 1. Non-cryptographic RNGs, should they be incorporated in security-critical applications are dangerous. If you insist on manufacturing poisonous chemicals that look appetizing and say “Kool-Aid” on them, kids are going to drink them. And this is your damned fault. 2. Non-cryptographic RNGs should not be evaluated and improved so as to (appear to provide) security properties. Non-invertability is a security property. Anyone who needs this property probably wants something that has been properly evaluated by experts to provide it. This construction has not been, and it is appropriate to assume that against a sufficiently-motivated adversary it will not provide it. Assuming otherwise is stupid and dangerous. 3. People who can use a non-cryptographic RNG but can’t afford the compute of a full cryptographic RNG are a very small subset of all users with very specific computing limitations. If you must target them with something, you should justify your computing speedup. My proposal is that this type of non-cryptographic RNG should have a name that is not easily confused with safe cryptographic PRNGs. Perhaps “statistical sequence generator”. Moreover, people designing these systems should not be playing with security properties. Do one thing or the other, but not both things badly. The set of people who need fast statistical (but insecure) sequence generators is small. They know who they are and what they need. Stop littering the school yard with poisonous chemicals that say “Kool Aid” in an effort to reach a few hundred laboratory chemists who are perfectly capable of calling you and ordering exactly the ingredients they know they need.
  - 5y ago