4 ms·
An alternative to the post is to take any PRNG's output and calculate the SHA3 hash of it, then use the hash as the random number. If SHA3 is not available, use
by glitchc 3y ago
An alternative to the post is to take any PRNG's output and calculate the SHA3 hash of it, then use the hash as the random number. If SHA3 is not available, use AES. In either case, all statistical weaknesses and side-channel attacks will be eliminated.
The platform is far more likely to have support for either of those in the system libraries, than a bespoke CSPRNG, which would need to be packaged with your app/game.
- josephg 3y agoThat might be convenient so you don’t have to go fishing for 3rd party libraries - which is especially a problem in C/C++. But I expect the result will be much slower than using an optimized csrng like chacha.
- glitchc 3y agoWell, ChaCha is actually a hash function. Specifically it was a candidate for SHA3 but was beaten by Keccak in the final spec. Additionally, aes-ctr-128 has the same performance as ChaCha (1.5 GB/s). All I was trying to illustrate was that in general, pairing a PRNG with a block cipher or hash function is sufficient to create a CSPRNG, and any developers worried about their PRNGs can couple rand() with a readily available cipher/hash in the system libraries. After all the blog is explicit about not requiring a cryptographically secure RNG for most applications.
- Thorham 3y agoChaChah is a stream cipher and was never a SHA3 candidate.
- tczajka 3y agoAs alright2565 already mentioned, sticking rand() in there doesn't add any benefit over a key + counter. Without rand() it would be something like SHA3-CTR -- it's not standardized which is why I would prefer ChaCha20, but it has been proposed for standardization and yes it's probably a fine algorithm.
- josephg 3y ago> it's probably a fine algorithm. Yeah. I'm nervous about inventing my own RNG. It seems like one of those things thats much more difficult than it appears on the surface. Especially an RNG thats aiming to be crypto-secure.
- tatersolid 3y ago> I'm nervous about inventing my own RNG. You should be, but in this case you’re actually not inventing your own CSPRNG. NIST SP 800-90A defines HASH_DRBG as hashing a seed (aka key) plus a counter and it is defined for basically any cryptographic hash function.
- alright2565 3y agoWould be better to simply use a counter and a random seed in that case. Who knows when your prng will loop around, but your counter will always loop at 2^32. At which point, if you use AES, you've just implemented the AES-CTR csprng that TFA suggests.
- deleted 3y ago[deleted]
- zuzun 3y agoThe sponge design of SHA-3 makes it a CSPRNG basically. You can keep draining it after you fed the data in.