3 ms·
A reason is if you're using a scheme that has information theoretic security, rather than computational, when instantiated with a TRNG. Hopefully adequately bu
by nullc 4y ago
A reason is if you're using a scheme that has information theoretic security, rather than computational, when instantiated with a TRNG.
Hopefully adequately built computational security is sufficient for any purpose, but this is a certificational difference-- hopefully not one in practice but potentially one in the kind of guarantees that you can give. (E.g. you can't prove that someone doesn't secretly know how to invert a HMAC-DRBG to get its state given a large chunk of its output)
It would be pretty foolish to use a IT security scheme just to destroy the property by using a DRBG to source its random numbers.
That said, since TRNGs are mostly interesting to snake oil drinkers there is good reason to expect most TRNG to be poorly constructed. (E.g. it's really common to see then dropping output based on a NIST SP 800-22, thus technically resulting in a biased output).