Cryptographically secure pseudorandom number generator explained

A cryptographically secure pseudorandom number generator (CSPRNG) or cryptographic pseudorandom number generator (CPRNG) is a pseudorandom number generator (PRNG) with properties that make it suitable for use in cryptography. It is also referred to as a cryptographic random number generator (CRNG).

Background

Most cryptographic applications require random numbers, for example:

• key generation
• initialization vectors
• nonces
• salts in certain signature schemes, including ECDSA and RSASSA-PSS
• token generation

The "quality" of the randomness required for these applications varies. For example, creating a nonce in some protocols needs only uniqueness. On the other hand, the generation of a master key requires a higher quality, such as more entropy. And in the case of one-time pads, the information-theoretic guarantee of perfect secrecy only holds if the key material comes from a true random source with high entropy, and thus any kind of pseudorandom number generator is insufficient.

Ideally, the generation of random numbers in CSPRNGs uses entropy obtained from a high-quality source, generally the operating system's randomness API. However, unexpected correlations have been found in several such ostensibly independent processes. From an information-theoretic point of view, the amount of randomness, the entropy that can be generated, is equal to the entropy provided by the system. But sometimes, in practical situations, numbers are needed with more randomness than the available entropy can provide. Also, the processes to extract randomness from a running system are slow in actual practice. In such instances, a CSPRNG can sometimes be used. A CSPRNG can "stretch" the available entropy over more bits.

Requirements

The requirements of an ordinary PRNG are also satisfied by a cryptographically secure PRNG, but the reverse is not true. CSPRNG requirements fall into two groups:

1. They pass statistical randomness tests:
   • Every CSPRNG should satisfy the next-bit test. That is, given the first k bits of a random sequence, there is no polynomial-time algorithm that can predict the (k+1)th bit with probability of success non-negligibly better than 50%.^[1] Andrew Yao proved in 1982 that a generator passing the next-bit test will pass all other polynomial-time statistical tests for randomness.^[2]
2. They hold up well under serious attack, even when part of their initial or running state becomes available to an attacker:
   • Every CSPRNG should withstand "state compromise extension attacks".^[3] In the event that part or all of its state has been revealed (or guessed correctly), it should be impossible to reconstruct the stream of random numbers prior to the revelation. Additionally, if there is an entropy input while running, it should be infeasible to use knowledge of the input's state to predict future conditions of the CSPRNG state.

For instance, if the PRNG under consideration produces output by computing bits of pi in sequence, starting from some unknown point in the binary expansion, it may well satisfy the next-bit test and thus be statistically random, as pi appears to be a random sequence. However, this algorithm is not cryptographically secure; an attacker who determines which bit of pi is currently in use (i.e. the state of the algorithm) will be able to calculate all preceding bits as well.

Most PRNGs are not suitable for use as CSPRNGs and will fail on both counts. First, while most PRNGs' outputs appear random to assorted statistical tests, they do not resist determined reverse engineering. Specialized statistical tests may be found specially tuned to such a PRNG that shows the random numbers not to be truly random. Second, for most PRNGs, when their state has been revealed, all past random numbers can be retrodicted, allowing an attacker to read all past messages, as well as future ones.

CSPRNGs are designed explicitly to resist this type of cryptanalysis.

Definitions

In the asymptotic setting, a family of deterministic polynomial time computable functions

G ^{k\to\{ 0 , 1 \}} _{k\colon\{ 0 , 1 \}} ^{p(k)} for some polynomial, is a pseudorandom number generator (PRNG, or PRG in some references), if it stretches the length of its input (p(k) > k for any), and if its output is computationally indistinguishable from true randomness, i.e. for any probabilistic polynomial time algorithm, which outputs 1 or 0 as a distinguisher,\left|\Pr ^{k}[A(G(x)) =1 ]} _{x\gets\{ 0 , 1 \} - \Pr ^{p(k)} _{r\gets\{ 0 , 1 \} }[A(r)=1]\right| < \mu(k)\mu .^[4] (The notation x\gets X means that is chosen uniformly at random from the set .)

There is an equivalent characterization: For any function family

G ^{k\to\{ 0 , 1 \}} _{k\colon\{ 0 , 1 \}} ^{p(k)} , is a PRNG if and only if the next output bit of cannot be predicted by a polynomial time algorithm.^[5]

A forward-secure PRNG with block length

t(k) is a PRNG G ^{k\to\{ 0 , 1 \}} _{k\colon\{ 0 , 1 \}} ^{k x \{0,1\}} ^{t(k)} , where the input string s _{i} with length is the current state at period, and the output (s _{i+1} , y _{i} ) consists of the next state s _{i+1} and the pseudorandom output block y _{i} of period, that withstands state compromise extensions in the following sense. If the initial state s _{1} is chosen uniformly at random from \{ 0 , 1 \} ^{k} , then for any, the sequence (y _{1,y} _{2,...,y} _{i,s} _{i+1} ) must be computationally indistinguishable from (r _{1,r} _{2,...,r} _{i,s} _{i+1} ) , in which the r _{i} are chosen uniformly at random from \{ 0 , 1 \} ^{t(k)} .^[6]

Any PRNG

G\colon\{ 0 , 1 \} ^{k\to\{0,1\}} ^{p(k)} can be turned into a forward secure PRNG with block length p(k) - k by splitting its output into the next state and the actual output. This is done by setting G(s) = G _{0(s)\Vert} G _{1(s)} , in which |G _{0(s)|} = |s| = k and |G _{1(s)|} = p(k) - k ; then is a forward secure PRNG with G _{0} as the next state and G _{1} as the pseudorandom output block of the current period.

Entropy extraction

See main article: Randomness extractor.

Santha and Vazirani proved that several bit streams with weak randomness can be combined to produce a higher-quality, quasi-random bit stream.^[7] Even earlier, John von Neumann proved that a simple algorithm can remove a considerable amount of the bias in any bit stream,^[8] which should be applied to each bit stream before using any variation of the Santha–Vazirani design.

Designs

CSPRNG designs are divided into two classes:

1. Designs based on cryptographic primitives such as ciphers and cryptographic hashes
2. Designs based on mathematical problems thought to be hard

Designs based on cryptographic primitives

• A secure block cipher can be converted into a CSPRNG by running it in counter mode using, for example, a special construct that the NIST in SP 800-90A calls CTR_DRBG. CTR_DBRG typically uses Advanced Encryption Standard (AES).
  • AES-CTR_DRBG is often used as a random number generator in systems that use AES encryption.^{[9] [10]}
  • The NIST CTR_DRBG scheme erases the key after the requested randomness is output by running additional cycles. This is wasteful from a performance perspective, but does not immediately cause issues with forward secrecy. However, realizing the performance implications, the NIST recommends an "extended AES-CTR-DRBG interface" for its Post-Quantum Cryptography Project submissions. This interface allows multiple sets of randomness to be generated without intervening erasure, only erasing when the user explicitly signals the end of requests. As a result, the key could remain in memory for an extended time if the "extended interface" is misused. Newer "fast-key-erasure" RNGs erase the key with randomness as soon as randomness is requested.^[11]
• A stream cipher can be converted into a CSPRNG. This has been done with RC4, ISAAC, and ChaCha20, to name a few.
• A cryptographically secure hash might also be a base of a good CSPRNG, using, for example, a construct that NIST calls Hash_DRBG.
• An HMAC primitive can be used as a base of a CSPRNG, for example, as part of the construct that NIST calls HMAC_DRBG.

Number-theoretic designs

• The Blum Blum Shub algorithm has a security proof based on the difficulty of the quadratic residuosity problem. Since the only known way to solve that problem is to factor the modulus, it is generally regarded that the difficulty of integer factorization provides a conditional security proof for the Blum Blum Shub algorithm. However the algorithm is very inefficient and therefore impractical unless extreme security is needed.
• The Blum–Micali algorithm has a security proof based on the difficulty of the discrete logarithm problem but is also very inefficient.
• Daniel Brown of Certicom wrote a 2006 security proof for Dual EC DRBG, based on the assumed hardness of the Decisional Diffie–Hellman assumption, the x-logarithm problem, and the truncated point problem. The 2006 proof explicitly assumes a lower outlen (amount of bits provided per iteration) than in the Dual_EC_DRBG standard, and that the P and Q in the Dual_EC_DRBG standard (which were revealed in 2013 to be probably backdoored by NSA) are replaced with non-backdoored values.

Practical schemes

"Practical" CSPRNG schemes not only include an CSPRNG algorithm, but also a way to initialize ("seed") it while keeping the seed secret. A number of such schemes have been defined, including:

• Implementations of /dev/random in Unix-like systems.
  • Yarrow, which attempts to evaluate the entropic quality of its seeding inputs, and uses SHA-1 and 3DES internally. Yarrow was used in macOS and other Apple OS' up until about December 2019, after which it switched to Fortuna.
  • Fortuna, the successor to Yarrow, which does not attempt to evaluate the entropic quality of its inputs; it uses SHA-256 and "any good block cipher". Fortuna is used in FreeBSD. Apple changed to Fortuna for most or all Apple OSs beginning around Dec. 2019.
  • The Linux kernel CSPRNG, which uses ChaCha20 to generate data,^[12] and BLAKE2s to ingest entropy.^[13]
• arc4random, a CSPRNG in Unix-like systems that seeds from . It originally is based on RC4, but all main implementations now use ChaCha20.^{[14] [15] [16]}
• CryptGenRandom, part of Microsoft's CryptoAPI, offered on Windows. Different versions of Windows use different implementations.
• ANSI X9.17 standard (Financial Institution Key Management (wholesale)), which has been adopted as a FIPS standard as well. It takes as input a TDEA (keying option 2) key bundle k and (the initial value of) a 64-bit random seed s.^[17] Each time a random number is required, it executes the following steps:

Obviously, the technique is easily generalized to any block cipher; AES has been suggested.^[18] If the key k is leaked, the entire X9.17 stream can be predicted; this weakness is cited as a reason for creating Yarrow.^[19]

All these above-mentioned schemes, save for X9.17, also mix the state of a CSPRNG with an additional source of entropy. They are therefore not "pure" pseudorandom number generators, in the sense that the output is not completely determined by their initial state. This addition aims to prevent attacks even if the initial state is compromised.

Standards

Several CSPRNGs have been standardized. For example:

• FIPS 186-4^[20]
• NIST SP 800-90A

• NIST SP 800-90A Rev.1

• ANSI X9.17-1985 Appendix C
• ANSI X9.31-1998 Appendix A.2.4
• ANSI X9.62-1998 Annex A.4, obsoleted by ANSI X9.62-2005, Annex D (HMAC_DRBG)

A good reference is maintained by NIST.^[21]

There are also standards for statistical testing of new CSPRNG designs:

• A Statistical Test Suite for Random and Pseudorandom Number Generators, NIST Special Publication 800-22.^[22]

NSA kleptographic backdoor in the Dual_EC_DRBG PRNG

The Guardian and The New York Times reported in 2013 that the National Security Agency (NSA) inserted a backdoor into a pseudorandom number generator (PRNG) of NIST SP 800-90A, which allows the NSA to readily decrypt material that was encrypted with the aid of Dual EC DRBG. Both papers reported^{[23] [24]} that, as independent security experts long suspected,^[25] the NSA had been introducing weaknesses into CSPRNG standard 800-90; this being confirmed for the first time by one of the top-secret documents leaked to The Guardian by Edward Snowden. The NSA worked covertly to get its own version of the NIST draft security standard approved for worldwide use in 2006. The leaked document states that "eventually, NSA became the sole editor". In spite of the known potential for a kleptographic backdoor and other known significant deficiencies with Dual_EC_DRBG, several companies such as RSA Security continued using Dual_EC_DRBG until the backdoor was confirmed in 2013.^[26] RSA Security received a $10 million payment from the NSA to do so.^[27]

Security flaws

DUHK attack

On October 23, 2017, Shaanan Cohney, Matthew Green, and Nadia Heninger, cryptographers at the University of Pennsylvania and Johns Hopkins University, released details of the DUHK (Don't Use Hard-coded Keys) attack on WPA2 where hardware vendors use a hardcoded seed key for the ANSI X9.31 RNG algorithm, stating "an attacker can brute-force encrypted data to discover the rest of the encryption parameters and deduce the master encryption key used to encrypt web sessions or virtual private network (VPN) connections."^{[28] [29]}

Japanese PURPLE cipher machine

During World War II, Japan used a cipher machine for diplomatic communications; the United States was able to crack it and read its messages, mostly because the "key values" used were insufficiently random.

External links

• , Randomness Requirements for Security
• Java "entropy pool" for cryptographically secure unpredictable random numbers.
• Java standard class providing a cryptographically strong pseudo-random number generator (PRNG).
• Cryptographically Secure Random number on Windows without using CryptoAPI
• Conjectured Security of the ANSI-NIST Elliptic Curve RNG, Daniel R. L. Brown, IACR ePrint 2006/117.
• A Security Analysis of the NIST SP 800-90 Elliptic Curve Random Number Generator, Daniel R. L. Brown and Kristian Gjosteen, IACR ePrint 2007/048. To appear in CRYPTO 2007.
• Cryptanalysis of the Dual Elliptic Curve Pseudorandom Generator, Berry Schoenmakers and Andrey Sidorenko, IACR ePrint 2006/190.
• Efficient Pseudorandom Generators Based on the DDH Assumption, Reza Rezaeian Farashahi and Berry Schoenmakers and Andrey Sidorenko, IACR ePrint 2006/321.
• Analysis of the Linux Random Number Generator, Zvi Gutterman and Benny Pinkas and Tzachy Reinman.
• NIST Statistical Test Suite documentation and software download.

Notes and References

1. Book: Katz. Jonathan. Lindell. Yehuda. 2008. Introduction to Modern Cryptography. CRC press. 70. 978-1584885511.
2. [Andrew Chi-Chih Yao]
3. Book: Kelsey . John . Schneier . Bruce . Wagner . David . Hall . Chris . Fast Software Encryption . Cryptanalytic Attacks on Pseudorandom Number Generators . Springer Berlin Heidelberg . Berlin, Heidelberg . 1998 . 978-3-540-64265-7 . 0302-9743 . 10.1007/3-540-69710-1_12 .
4. , def 3.3.1.
5. , Theorem 3.3.7.
6. , def 4.
7. Miklos Santha, Umesh V. Vazirani. Generating quasi-random sequences from slightly-random sources. Proceedings of the 25th IEEE Symposium on Foundations of Computer Science. 434–440. University of California. 1984-10-24. 0-8186-0591-X. 2006-11-29.
8. Book: John von Neumann. John von Neumann. The Collected Works of John von Neumann. Pergamon Press. 1963-03-01. 768–770. Various techniques for use in connection with random digits. 0-08-009566-6.
9. Book: David . Kleidermacher . Mike . Kleidermacher . Embedded Systems Security: Practical Methods for Safe and Secure Software and Systems Development . Elsevier . 2012 . 256. 9780123868862 .
10. Web site: George . Cox . Charles . Dike . DJ . Johnston . Intel's Digital Random Number Generator (DRNG) . 2011.
11. Web site: Bernstein . Daniel J. . 2017.07.23: Fast-key-erasure random-number generators: An effort to clean up several messes simultaneously. #rng #forwardsecrecy #urandom #cascade #hmac #rekeying #proofs .
12. Web site: Github . Github commit of random.c . July 2, 2016.
13. Web site: Linux 5.17 Random Number Generator Seeing Speed-Ups, Switching From SHA1 To BLAKE2s - Phoronix . www.phoronix.com.
14. Web site: CVS . CVS log of arc4random.c . October 1, 2013.
15. Web site: CVS . CVS log of arc4random.c . November 16, 2014.
16. Web site: FreeBSD 12.0-RELEASE Release Notes: Runtime Libraries and API . 5 March 2019 . FreeBSD.org . 24 August 2019 .
17. Book: Handbook of Applied Cryptography . Alfred . Menezes . Paul . van Oorschot . Scott . Vanstone . Alfred Menezes . Paul van Oorschot . Scott Vanstone . CRC Press . 1996 . Chapter 5: Pseudorandom Bits and Sequences . http://www.cacr.math.uwaterloo.ca/hac/about/chap5.pdf.
18. Book: Adam . Young . Moti . Yung. Malicious Cryptography: Exposing Cryptovirology. John Wiley & Sons. 2004-02-01. sect 3.5.1. 978-0-7645-4975-5.
19. Book: Kelsey . John . Schneier . Bruce . Ferguson . Niels . Yarrow-160: Notes on the Design and Analysis of the Yarrow Cryptographic Pseudorandom Number Generator . Sixth Annual Workshop on Selected Areas in Cryptography . Lecture Notes in Computer Science . August 1999 . 1758 . 13–33 . 10.1007/3-540-46513-8_2 . 978-3-540-67185-5 . https://www.schneier.com/wp-content/uploads/2016/02/paper-yarrow.pdf.
20. Web site: FIPS 186-4.
21. Web site: Computer Security Division . Information Technology Laboratory . Random Number . CSRC NIST . 24 May 2016 . EN-US.
22. Rukhin . Andrew . Soto . Juan . Nechvatal . James . Smid . Miles . Barker . Elaine . Leigh . Stefan . Levenson . Mark . Vangel . Mark . Banks . David . Heckert . N. . Dray . James . Vo . San . Bassham . Lawrence . April 30, 2010 . A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications . NIST . 10.6028/NIST.SP.800-22r1a . csrc.nist.gov . free.
23. Web site: Revealed: how US and UK spy agencies defeat internet privacy and security. The Guardian. 7 September 2013. James Borger. Glenn Greenwald. 6 September 2013.
24. News: N.S.A. Able to Foil Basic Safeguards of Privacy on Web. The New York Times. 7 September 2013. Nicole Perlroth. 5 September 2013.
25. Did NSA Put a Secret Backdoor in New Encryption Standard?. Wired. 7 September 2013. Bruce Schneier. 15 November 2007.
26. Web site: RSA warns developers not to use RSA products. Matthew Green. 20 September 2013 .
27. News: Exclusive: Secret contract tied NSA and security industry pioneer. Joseph Menn . Reuters. 20 December 2013.
28. Web site: Practical state recovery attacks against legacy RNG implementations. duhkattack.com. Shaanan Cohney. Shaanan Cohney. Matthew D. Green. Matthew D. Green. Nadia Heninger. Nadia Heninger.
29. Web site: DUHK Crypto Attack Recovers Encryption Keys, Exposes VPN Connections. slashdot.org. 25 October 2017 . 25 October 2017.