4 ms·

I don't understand how an RNG can be compromised to the point that it's got very little entropy, yet still be able to pass randomness tests. Can anyone explain?

by jstalin 13y ago

makomk 13y ago
The RNG in question is deliberately designed to use AES as a way of stretching out a limited amount of hardware entropy into a much larger amount of output entropy. Because of the way AES works, unless you know the encryption key it's essentially impossible to distinguish the output from truely random data.
ReidZB 13y ago
Randomness tests mean extremely little for cryptographic PRNGs [1]. Passing a statistical test basically just means that your RNG isn't horribly, awfully broken. Such tests mean almost nothing in terms of cryptographic security. A statistical test just determines if the output of a PRNG "looks random" from a very, very narrow point of view, typically not algorithm-specific and often predefined ahead of time. Cryptographic security, on the other hand, requires defending against an intelligent adversary who actively seeks to subjugate and compromise the unpredictability of the specific PRNG in question. As an example, the Mersenne Twister passes many of the popular statistical tests with flying colors, but learning 624 consecutive values from it allows an attacker to reconstruct its internal state and predict all future values. (That is, it's totally worthless when it comes to cryptographic security.) [1] http://security.stackexchange.com/a/32416/1373 http://security.stackexchange.com/a/32416/1373
ajross 13y ago
Because that's not what randomness tests test. :) The output of every block cipher in the world would be expected to pass randomness tests. The output of a specific block cipher with a hard-coded publicly known key will obviously not provide any cryptographic security to uits users.

4 ms·

I don't understand how an RNG can be compromised to the point that it's got very little entropy, yet still be able to pass randomness tests. Can anyone explain?

by jstalin 13y ago

I don't understand how an RNG can be compromised to the point that it's got very little entropy, yet still be able to pass randomness tests. Can anyone explain?

makomk 13y ago
The RNG in question is deliberately designed to use AES as a way of stretching out a limited amount of hardware entropy into a much larger amount of output entropy. Because of the way AES works, unless you know the encryption key it's essentially impossible to distinguish the output from truely random data.
ReidZB 13y ago
Randomness tests mean extremely little for cryptographic PRNGs [1]. Passing a statistical test basically just means that your RNG isn't horribly, awfully broken. Such tests mean almost nothing in terms of cryptographic security. A statistical test just determines if the output of a PRNG "looks random" from a very, very narrow point of view, typically not algorithm-specific and often predefined ahead of time. Cryptographic security, on the other hand, requires defending against an intelligent adversary who actively seeks to subjugate and compromise the unpredictability of the specific PRNG in question. As an example, the Mersenne Twister passes many of the popular statistical tests with flying colors, but learning 624 consecutive values from it allows an attacker to reconstruct its internal state and predict all future values. (That is, it's totally worthless when it comes to cryptographic security.) [1] http://security.stackexchange.com/a/32416/1373 http://security.stackexchange.com/a/32416/1373
ajross 13y ago
Because that's not what randomness tests test. :) The output of every block cipher in the world would be expected to pass randomness tests. The output of a specific block cipher with a hard-coded publicly known key will obviously not provide any cryptographic security to uits users.