Terms & Definitions
pseudo-random number generator
A pseudo-random number generator, or PRNG,
is a random number generator that produces a sequence
of values based on a seed and a current state.
Given the same seed, a PRNG will always output
the same sequence of values.
The term pseudo is not intended to be a
pejorative term.
There exist PRNG's such as the Blum-Blum-Shub
PRNG that have been proved to be
cryptographically strong.
PRNGs do have a problem that non-deterministic random
number generators to not have: the selection and security of the seed.
To achieve output unpredictability of high quality PRNG,
one must start with an unpredictable seed.
Using second PRNG to create the seed does not help
because that simply transfers the problem of seeding onto the
second PRNG.
Worse yet, using a PRNG to repeatedly seed another (or even worse
the same) PRNG usually degrades the quality of the output.
One way to resolve this ''Chicken & Egg'' problem
is to use a non-pseudo random number generator such as
a hardware random number generator, to produce a seed
for a PRNG.
The seed of a PRNG is analogous to a key of a cipher.
In fact, some ciphers (e.g., RC4) use a PRNG internally,
seeded by the key, to mix pseudo-random output with plain-text
to produce cipher text.
The discovery of a PRNG's seed is analogous to the discovery of a
cipher's key.
One must protect the PRNG seed from unauthorized disclosure.
One must select the PRNG seed in such a way that it
is not easily guessed.
|
