202:. However, unexpected correlations have been found in several such ostensibly independent processes. From an information-theoretic point of view, the amount of randomness, the entropy that can be generated, is equal to the entropy provided by the system. But sometimes, in practical situations, numbers are needed with more randomness than the available entropy can provide. Also, the processes to extract randomness from a running system are slow in actual practice. In such instances, a CSPRNG can sometimes be used. A CSPRNG can "stretch" the available entropy over more bits.
3748:
65:
2190:
All these above-mentioned schemes, save for X9.17, also mix the state of a CSPRNG with an additional source of entropy. They are therefore not "pure" pseudorandom number generators, in the sense that the output is not completely determined by their initial state. This addition aims to prevent attacks
267:
Most PRNGs are not suitable for use as CSPRNGs and will fail on both counts. First, while most PRNGs' outputs appear random to assorted statistical tests, they do not resist determined reverse engineering. Specialized statistical tests may be found specially tuned to such a PRNG that shows the random
2233:
When the maximum number of bits output from this PRNG is equal to the 2, the resulting output delivers the mathematically expected security level that the key size would be expected to generate, but the output is shown to not be indistinguishable from a true random number generator. When the maximum
249:
Every CSPRNG should withstand "state compromise extension attacks". In the event that part or all of its state has been revealed (or guessed correctly), it should be impossible to reconstruct the stream of random numbers prior to the revelation. Additionally, if there is an entropy input while
1866:
the requested randomness is output by running additional cycles. This is wasteful from a performance perspective, but does not immediately cause issues with forward secrecy. However, realizing the performance implications, the NIST recommends an "extended AES-CTR-DRBG interface" for its
1871:
submissions. This interface allows multiple sets of randomness to be generated without intervening erasure, only erasing when the user explicitly signals the end of requests. As a result, the key could remain in memory for an extended time if the "extended interface" is misused. Newer
2957:
Is there any serious argument that adding new entropy all the time is a good thing? The Linux /dev/urandom manual page claims that without new entropy the user is "theoretically vulnerable to a cryptographic attack", but (as I've mentioned in various venues) this is a ludicrous
2392:
where hardware vendors use a hardcoded seed key for the ANSI X9.31 RNG algorithm, stating "an attacker can brute-force encrypted data to discover the rest of the encryption parameters and deduce the master encryption key used to encrypt web sessions or
2014:, the successor to Yarrow, which does not attempt to evaluate the entropic quality of its inputs; it uses SHA-256 and "any good block cipher". Fortuna is used in FreeBSD. Apple changed to Fortuna for most or all Apple OSs beginning around Dec. 2019.
610:
2348:. The NSA worked covertly to get its own version of the NIST draft security standard approved for worldwide use in 2006. The leaked document states that "eventually, NSA became the sole editor". In spite of the known potential for a
2340:. Both papers reported that, as independent security experts long suspected, the NSA had been introducing weaknesses into CSPRNG standard 800-90; this being confirmed for the first time by one of the top-secret documents leaked to
918:
264:. However, this algorithm is not cryptographically secure; an attacker who determines which bit of pi is currently in use (i.e. the state of the algorithm) will be able to calculate all preceding bits as well.
268:
numbers not to be truly random. Second, for most PRNGs, when their state has been revealed, all past random numbers can be retrodicted, allowing an attacker to read all past messages, as well as future ones.
3114:
Rukhin, Andrew; Soto, Juan; Nechvatal, James; Smid, Miles; Barker, Elaine; Leigh, Stefan; Levenson, Mark; Vangel, Mark; Banks, David; Heckert, N.; Dray, James; Vo, San; Bassham, Lawrence (April 30, 2010).
763:
371:
1472:
1315:
1231:
86:
1580:
3781:
2234:
number of bits output from this PRNG is less than it, the expected security level is delivered and the output appears to be indistinguishable from a true random number generator.
195:
guarantee of perfect secrecy only holds if the key material comes from a true random source with high entropy, and thus any kind of pseudorandom number generator is insufficient.
1715:
1648:
1929:
provides a conditional security proof for the Blum Blum Shub algorithm. However the algorithm is very inefficient and therefore impractical unless extreme security is needed.
1390:
2743:"2017.07.23: Fast-key-erasure random-number generators: An effort to clean up several messes simultaneously. #rng #forwardsecrecy #urandom #cascade #hmac #rekeying #proofs"
260:
in sequence, starting from some unknown point in the binary expansion, it may well satisfy the next-bit test and thus be statistically random, as pi is conjectured to be a
2802:
1143:
414:
662:
1046:
986:
1797:
can remove a considerable amount of the bias in any bit stream, which should be applied to each bit stream before using any variation of the Santha–Vazirani design.
1507:
1773:
1746:
1342:
1104:
1073:
1013:
945:
434:
2230:
of the underlying block cipher when the number of bits output from this PRNG is greater than two to the power of the underlying block cipher's block size in bits.
807:
636:
210:
The requirements of an ordinary PRNG are also satisfied by a cryptographically secure PRNG, but the reverse is not true. CSPRNG requirements fall into two groups:
1789:
Santha and
Vazirani proved that several bit streams with weak randomness can be combined to produce a higher-quality, quasi-random bit stream. Even earlier,
2724:
2788:
3289:
3069:
3256:
2365:
198:
Ideally, the generation of random numbers in CSPRNGs uses entropy obtained from a high-quality source, generally the operating system's randomness
2056:
812:
1868:
3411:
2356:
continued using Dual_EC_DRBG until the backdoor was confirmed in 2013. RSA Security received a $ 10 million payment from the NSA to do so.
3171:
2756:
1977:
in the Dual_EC_DRBG standard (which were revealed in 2013 to be probably backdoored by NSA) are replaced with non-backdoored values.
1953:
3197:
2070:
2004:, which attempts to evaluate the entropic quality of its seeding inputs, and uses SHA-1 and 3DES internally. Yarrow was used in
682:
290:
241:
proved in 1982 that a generator passing the next-bit test will pass all other polynomial-time statistical tests for randomness.
2932:
2892:
2579:
2554:
2521:
2499:
Kelsey, John; Schneier, Bruce; Wagner, David; Hall, Chris (1998). "Cryptanalytic
Attacks on Pseudorandom Number Generators".
2062:
3223:
246:
They hold up well under serious attack, even when part of their initial or running state becomes available to an attacker:
2212:
This withdrawn standard has four PRNGs. Two of them are uncontroversial and proven: CSPRNGs named Hash_DRBG and HMAC_DRBG.
1925:. Since the only known way to solve that problem is to factor the modulus, it is generally regarded that the difficulty of
1398:
1236:
1152:
250:
running, it should be infeasible to use knowledge of the input's state to predict future conditions of the CSPRNG state.
2464:
421:
3786:
3776:
3404:
2707:
2680:
2642:
112:
94:
3145:
2241:
for CTR_DRBG depends on limiting the total number of generate requests and the bits provided per generate request.
1856:
1837:
1794:
1512:
669:
2226:. It has an uncontroversial design but has been proven to be weaker in terms of distinguishing attack, than the
3607:
90:
2329:
2187:
is leaked, the entire X9.17 stream can be predicted; this weakness is cited as a reason for creating Yarrow.
1922:
378:
36:
3238:
3397:
3340:
2456:
2261:
This is essentially NIST SP 800-90A with Dual_EC_DRBG removed, and is the withdrawn standard's replacement.
2180:
1849:
165:
2816:
3723:
3678:
3491:
3380:
1889:
2910:"Yarrow-160: Notes on the Design and Analysis of the Yarrow Cryptographic Pseudorandom Number Generator"
3602:
3117:"A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications"
2909:
2381:
1937:
1653:
3345:
2500:
1585:
3718:
2406:
1933:
2878:
2410:
1347:
3708:
3698:
3553:
3331:
3116:
2634:
2385:
2321:
1903:
primitive can be used as a base of a CSPRNG, for example, as part of the construct that NIST calls
75:
2596:
2450:
3703:
3693:
3496:
3456:
3449:
3439:
3434:
2699:
Embedded
Systems Security: Practical Methods for Safe and Secure Software and Systems Development
2394:
1109:
79:
2771:"Linux 5.17 Random Number Generator Seeing Speed-Ups, Switching From SHA1 To BLAKE2s - Phoronix"
1986:"Practical" CSPRNG schemes not only include an CSPRNG algorithm, but also a way to initialize ("
171:
The "quality" of the randomness required for these applications varies. For example, creating a
3444:
3341:
Java standard class providing a cryptographically strong pseudo-random number generator (PRNG).
2352:
backdoor and other known significant deficiencies with Dual_EC_DRBG, several companies such as
384:
176:
641:
605:{\displaystyle \left|\Pr _{x\gets \{0,1\}^{k}}-\Pr _{r\gets \{0,1\}^{p(k)}}\right|<\mu (k)}
3751:
3597:
3543:
1926:
1018:
958:
142:
3371:, Reza Rezaeian Farashahi and Berry Schoenmakers and Andrey Sidorenko, IACR ePrint 2006/321.
3096:
3068:
2970:
1990:") it while keeping the seed secret. A number of such schemes have been defined, including:
1477:
3713:
3637:
3359:, Daniel R. L. Brown and Kristian Gjosteen, IACR ePrint 2007/048. To appear in CRYPTO 2007.
2884:
2409:, Japan used a cipher machine for diplomatic communications; the United States was able to
2325:
1784:
1751:
1724:
1509:
by splitting its output into the next state and the actual output. This is done by setting
1320:
1082:
1079:, that withstands state compromise extensions in the following sense. If the initial state
1051:
991:
923:
783:
621:
8:
3476:
2948:
2479:
2430:
1872:"fast-key-erasure" RNGs erase the key with randomness as soon as randomness is requested.
616:
284:
184:
172:
152:
147:
2854:
2483:
1969:(amount of bits provided per iteration) than in the Dual_EC_DRBG standard, and that the
3582:
3566:
3513:
3014:"The Notorious PRG: Formal verification of the HMAC-DRBG pseudorandom number generator"
2316:
1892:
might also be a base of a good CSPRNG, using, for example, a construct that NIST calls
1814:
192:
180:
2623:
2336:, which allows the NSA to readily decrypt material that was encrypted with the aid of
2078:
3642:
3632:
3503:
2928:
2888:
2846:
2703:
2676:
2638:
2575:
2550:
2527:
2517:
2486:. In Proceedings of the 23rd IEEE Symposium on Foundations of Computer Science, 1982.
2460:
2238:
2008:
and other Apple OS' up until about
December 2019, after which it switched to Fortuna.
1859:
_DRBG is often used as a random number generator in systems that use AES encryption.
3577:
3318:
3260:
3124:
3013:
2920:
2664:
2509:
2369:
2001:
1790:
256:
For instance, if the PRNG under consideration produces output by computing bits of
215:
2059:, offered on Windows. Different versions of Windows use different implementations.
3335:
2697:
2333:
2248:. It has been shown to not be cryptographically secure and is believed to have a
2206:
230:
3357:
A Security
Analysis of the NIST SP 800-90 Elliptic Curve Random Number Generator
3322:
3044:"Security Bounds for the NIST Codebook-based Deterministic Random Bit Generator"
3652:
3572:
3533:
3481:
3466:
3264:
2850:
2842:
2770:
2672:
2373:
2345:
2227:
2047:
2011:
1918:
1878:
137:
3329:
Java "entropy pool" for cryptographically secure unpredictable random numbers.
3129:
3770:
3733:
3688:
3647:
3627:
3523:
3486:
3461:
3095:
Computer
Security Division, Information Technology Laboratory (24 May 2016).
2952:
2742:
2667:(1963-03-01). "Various techniques for use in connection with random digits".
2531:
2513:
2377:
1877:
A stream cipher can be converted into a CSPRNG. This has been done with RC4,
272:
261:
222:
2924:
2271:
ANSI X9.62-1998 Annex A.4, obsoleted by ANSI X9.62-2005, Annex D (HMAC_DRBG)
381:(PRNG, or PRG in some references), if it stretches the length of its input (
3683:
3528:
3518:
3508:
3471:
3420:
3146:"Revealed: how US and UK spy agencies defeat internet privacy and security"
2429:
The use of entropy-mixing after CSPRNG initialization has been question by
2353:
2349:
2337:
2310:
2304:
2249:
2245:
2223:
2219:
2145:
1948:
1833:
913:{\displaystyle G_{k}\colon \{0,1\}^{k}\to \{0,1\}^{k}\times \{0,1\}^{t(k)}}
424:
from true randomness, i.e. for any probabilistic polynomial time algorithm
188:
126:
40:
3070:"Government Announces Steps to Restore Confidence on Encryption Standards"
16:
Type of functions designed for being unsolvable by root-finding algorithms
3662:
3346:
Cryptographically Secure Random number on
Windows without using CryptoAPI
2631:
Proceedings of the 25th IEEE Symposium on
Foundations of Computer Science
2092:. Each time a random number is required, it executes the following steps:
2086:
1987:
1820:
3255:
2861:
2282:
There are also standards for statistical testing of new CSPRNG designs:
3622:
3592:
3587:
3548:
2988:
2074:
2027:
238:
3374:
3290:"DUHK Crypto Attack Recovers Encryption Keys, Exposes VPN Connections"
3043:
2298:
2287:
A Statistical Test Suite for Random and
Pseudorandom Number Generators
237:+1)th bit with probability of success non-negligibly better than 50%.
3612:
3269:"Practical state recovery attacks against legacy RNG implementations"
2919:. Lecture Notes in Computer Science. Vol. 1758. pp. 13–33.
2388:, released details of the DUHK (Don't Use Hard-coded Keys) attack on
2052:
1904:
1893:
179:
needs only uniqueness. On the other hand, the generation of a master
2179:
Obviously, the technique is easily generalized to any block cipher;
64:
3657:
3617:
3268:
3239:"Exclusive: Secret contract tied NSA and security industry pioneer"
2413:, mostly because the "key values" used were insufficiently random.
2215:
2040:
2017:
The Linux kernel CSPRNG, which uses ChaCha20 to generate data, and
1944:
1882:
1845:
3368:
3362:
3356:
3350:
2018:
679:
There is an equivalent characterization: For any function family
287:, a family of deterministic polynomial time computable functions
3381:
NIST Statistical Test Suite documentation and software download.
3365:, Berry Schoenmakers and Andrey Sidorenko, IACR ePrint 2006/190.
2624:"Generating quasi-random sequences from slightly-random sources"
2621:
3538:
3363:
Cryptanalysis of the Dual
Elliptic Curve Pseudorandom Generator
2817:"FreeBSD 12.0-RELEASE Release Notes: Runtime Libraries and API"
1810:
160:
130:
2908:
Kelsey, John; Schneier, Bruce; Ferguson, Niels (August 1999).
1921:
algorithm has a security proof based on the difficulty of the
3369:
Efficient Pseudorandom Generators Based on the DDH Assumption
2005:
156:
1826:
3198:"Did NSA Put a Secret Backdoor in New Encryption Standard?"
3143:
2841:
2389:
2276:
1900:
1841:
1474:
can be turned into a forward secure PRNG with block length
3094:
2695:
2036:
758:{\displaystyle G_{k}\colon \{0,1\}^{k}\to \{0,1\}^{p(k)}}
366:{\displaystyle G_{k}\colon \{0,1\}^{k}\to \{0,1\}^{p(k)}}
199:
3351:
Conjectured Security of the ANSI-NIST Elliptic Curve RNG
3328:
3172:"N.S.A. Able to Foil Basic Safeguards of Privacy on Web"
2498:
1775:
as the pseudorandom output block of the current period.
39:(PRNG) with properties that make it suitable for use in
3782:
Cryptographically secure pseudorandom number generators
3113:
2917:
Sixth Annual Workshop on Selected Areas in Cryptography
2870:
271:
CSPRNGs are designed explicitly to resist this type of
257:
3559:
Cryptographically secure pseudorandom number generator
2907:
21:
cryptographically secure pseudorandom number generator
2199:
Several CSPRNGs have been standardized. For example:
1819:
Designs based on mathematical problems thought to be
1754:
1727:
1656:
1588:
1515:
1480:
1467:{\displaystyle G\colon \{0,1\}^{k}\to \{0,1\}^{p(k)}}
1401:
1350:
1323:
1239:
1155:
1112:
1085:
1054:
1021:
994:
961:
926:
815:
786:
685:
644:
624:
437:
387:
293:
3385:
3377:, Zvi Gutterman and Benny Pinkas and Tzachy Reinman.
2244:
The fourth and final PRNG in this standard is named
1995:
1936:
has a security proof based on the difficulty of the
773:
cannot be predicted by a polynomial time algorithm.
2947:
2299:
NSA kleptographic backdoor in the Dual_EC_DRBG PRNG
3144:James Borger; Glenn Greenwald (6 September 2013).
2989:"Analysis of Underlying Assumptions in NIST DRBGs"
2696:Kleidermacher, David; Kleidermacher, Mike (2012).
2508:. Berlin, Heidelberg: Springer Berlin Heidelberg.
2237:It is noted in the next revision that the claimed
1809:Designs based on cryptographic primitives such as
1767:
1740:
1709:
1642:
1574:
1501:
1466:
1384:
1336:
1310:{\displaystyle (r_{1},r_{2},\dots ,r_{i},s_{i+1})}
1309:
1226:{\displaystyle (y_{1},y_{2},\dots ,y_{i},s_{i+1})}
1225:
1137:
1098:
1067:
1040:
1007:
980:
939:
912:
801:
757:
656:
630:
604:
408:
365:
2723:Cox, George; Dike, Charles; Johnston, DJ (2011).
2400:
1840:using, for example, a special construct that the
3768:
2725:"Intel's Digital Random Number Generator (DRNG)"
2663:
2067:Financial Institution Key Management (wholesale)
2031:, a CSPRNG in Unix-like systems that seeds from
1836:can be converted into a CSPRNG by running it in
769:is a PRNG if and only if the next output bit of
515:
444:
3169:
2880:Malicious Cryptography: Exposing Cryptovirology
2722:
2622:Miklos Santha, Umesh V. Vazirani (1984-10-24).
2598:Lecture 5 Notes of Introduction to Cryptography
1233:must be computationally indistinguishable from
3224:"RSA warns developers not to use RSA products"
3195:
2615:
3405:
3375:Analysis of the Linux Random Number Generator
3221:
2657:
2484:Theory and applications of trapdoor functions
1805:CSPRNG designs are divided into two classes:
2855:"Chapter 5: Pseudorandom Bits and Sequences"
1965:. The 2006 proof explicitly assumes a lower
1550:
1446:
1433:
1421:
1408:
1364:
1351:
1126:
1113:
892:
879:
867:
854:
842:
829:
737:
724:
712:
699:
538:
525:
467:
454:
345:
332:
320:
307:
3353:, Daniel R. L. Brown, IACR ePrint 2006/117.
3236:
3037:
3035:
3033:
2448:
1911:
1575:{\displaystyle G(s)=G_{0}(s)\Vert G_{1}(s)}
428:, which outputs 1 or 0 as a distinguisher,
93:. Unsourced material may be challenged and
29:cryptographic pseudorandom number generator
3412:
3398:
2901:
2572:Foundations of cryptography I: Basic Tools
2547:Foundations of cryptography I: Basic Tools
2191:even if the initial state is compromised.
3128:
3042:Campagna, Matthew J. (November 1, 2006).
2876:
2574:, Cambridge: Cambridge University Press,
2569:
2549:, Cambridge: Cambridge University Press,
2544:
1827:Designs based on cryptographic primitives
113:Learn how and when to remove this message
3137:
3066:
3041:
3030:
2953:"cr.yp.to: 2014.02.05: Entropy Attacks!"
2494:
2492:
2449:Katz, Jonathan; Lindell, Yehuda (2008).
1862:The NIST CTR_DRBG scheme erases the key
183:requires a higher quality, such as more
155:in certain signature schemes, including
3230:
3067:Perlroth, Nicole (September 10, 2013).
2669:The Collected Works of John von Neumann
2039:, but all main implementations now use
1951:, based on the assumed hardness of the
229:bits of a random sequence, there is no
3769:
3325:, Randomness Requirements for Security
2877:Young, Adam; Yung, Moti (2004-02-01).
2073:standard as well. It takes as input a
3393:
3215:
2740:
2489:
1778:
45:cryptographic random number generator
3170:Nicole Perlroth (5 September 2013).
2473:
2085:and (the initial value of) a 64-bit
1981:
1954:Decisional Diffie–Hellman assumption
1344:are chosen uniformly at random from
91:adding citations to reliable sources
58:
3222:Matthew Green (20 September 2013).
3196:Bruce Schneier (15 November 2007).
2986:
2734:
2452:Introduction to Modern Cryptography
2442:
2100:to the maximum resolution possible.
1106:is chosen uniformly at random from
13:
3012:Ye, Katherine Qinru (April 2016).
3011:
2941:
2289:, NIST Special Publication 800-22.
2275:A good reference is maintained by
1048:and the pseudorandom output block
14:
3798:
3312:
2987:Kan, Wilson (September 4, 2007).
2594:
2293:
2214:The third PRNG in this standard,
1869:Post-Quantum Cryptography Project
1710:{\displaystyle |G_{1}(s)|=p(k)-k}
422:computationally indistinguishable
3747:
3746:
3419:
3237:Joseph Menn (20 December 2013).
2863:Handbook of Applied Cryptography
1947:wrote a 2006 security proof for
1643:{\displaystyle |G_{0}(s)|=|s|=k}
233:algorithm that can predict the (
221:Every CSPRNG should satisfy the
63:
3282:
3249:
3189:
3163:
3107:
3088:
3060:
3005:
2980:
2963:
2835:
2809:
2795:
2781:
2763:
2749:
2716:
2423:
2183:has been suggested. If the key
2069:), which has been adopted as a
951:is the current state at period
205:
3608:Information-theoretic security
2689:
2588:
2563:
2538:
2411:crack it and read its messages
2401:Japanese PURPLE cipher machine
2359:
2268:ANSI X9.31-1998 Appendix A.2.4
1721:is a forward secure PRNG with
1698:
1692:
1682:
1678:
1672:
1658:
1630:
1622:
1614:
1610:
1604:
1590:
1569:
1563:
1547:
1541:
1525:
1519:
1490:
1484:
1459:
1453:
1430:
1385:{\displaystyle \{0,1\}^{t(k)}}
1377:
1371:
1304:
1240:
1220:
1156:
905:
899:
851:
796:
790:
750:
744:
721:
648:
599:
593:
579:
570:
564:
558:
551:
545:
522:
508:
499:
496:
490:
484:
478:
451:
397:
391:
358:
352:
329:
278:
43:. It is also referred to as a
1:
2416:
2330:pseudorandom number generator
2096:Obtain the current date/time
1940:but is also very inefficient.
1923:quadratic residuosity problem
1015:) consists of the next state
379:pseudorandom number generator
54:
37:pseudorandom number generator
2194:
2035:. It originally is based on
1850:Advanced Encryption Standard
7:
3724:Message authentication code
3679:Cryptographic hash function
3492:Cryptographic hash function
2757:"Github commit of random.c"
1888:A cryptographically secure
1138:{\displaystyle \{0,1\}^{k}}
225:. That is, given the first
10:
3803:
3603:Harvest now, decrypt later
3133:– via csrc.nist.gov.
2382:University of Pennsylvania
2320:reported in 2013 that the
2302:
2265:ANSI X9.17-1985 Appendix C
2144:, where ⊕ denotes bitwise
2103:Compute a temporary value
1938:discrete logarithm problem
1848:. CTR_DBRG typically uses
1800:
1782:
127:cryptographic applications
3742:
3719:Post-quantum cryptography
3671:
3427:
3389:
3130:10.6028/NIST.SP.800-22r1a
2805:. CVS. November 16, 2014.
2803:"CVS log of arc4random.c"
2789:"CVS log of arc4random.c"
2702:. Elsevier. p. 256.
2123:Compute the random value
920:, where the input string
409:{\displaystyle p(k)>k}
3787:Cryptographic primitives
3777:Cryptographic algorithms
3709:Quantum key distribution
3699:Authenticated encryption
3554:Random number generation
2635:University of California
2570:Goldreich, Oded (2001),
2545:Goldreich, Oded (2001),
2514:10.1007/3-540-69710-1_12
2502:Fast Software Encryption
2386:Johns Hopkins University
2322:National Security Agency
1912:Number-theoretic designs
657:{\displaystyle x\gets X}
420:), and if its output is
3704:Public-key cryptography
3694:Symmetric-key algorithm
3497:Key derivation function
3457:Cryptographic primitive
3450:Authentication protocol
3440:Outline of cryptography
3435:History of cryptography
2925:10.1007/3-540-46513-8_2
2791:. CVS. October 1, 2013.
2759:. Github. July 2, 2016.
2395:virtual private network
1963:truncated point problem
1041:{\displaystyle s_{i+1}}
981:{\displaystyle s_{i+1}}
780:PRNG with block length
672:at random from the set
3445:Cryptographic protocol
1998:in Unix-like systems.
1769:
1748:as the next state and
1742:
1711:
1644:
1576:
1503:
1502:{\displaystyle p(k)-k}
1468:
1386:
1338:
1311:
1227:
1139:
1100:
1069:
1042:
1009:
982:
941:
914:
803:
759:
658:
632:
606:
410:
367:
214:They pass statistical
143:initialization vectors
133:numbers, for example:
3598:End-to-end encryption
3544:Cryptojacking malware
2885:John Wiley & Sons
2741:Bernstein, Daniel J.
2455:. CRC press. p.
2364:On October 23, 2017,
2257:NIST SP 800-90A Rev.1
1934:Blum–Micali algorithm
1927:integer factorization
1770:
1768:{\displaystyle G_{1}}
1743:
1741:{\displaystyle G_{0}}
1712:
1645:
1577:
1504:
1469:
1387:
1339:
1337:{\displaystyle r_{i}}
1312:
1228:
1140:
1101:
1099:{\displaystyle s_{1}}
1070:
1068:{\displaystyle y_{i}}
1043:
1010:
1008:{\displaystyle y_{i}}
983:
942:
940:{\displaystyle s_{i}}
915:
804:
760:
659:
633:
607:
411:
368:
193:information-theoretic
187:. And in the case of
3714:Quantum cryptography
3638:Trusted timestamping
2675:. pp. 768–770.
2637:. pp. 434–440.
2397:(VPN) connections."
1844:in SP 800-90A calls
1815:cryptographic hashes
1785:Randomness extractor
1752:
1725:
1654:
1586:
1513:
1478:
1399:
1348:
1321:
1237:
1153:
1110:
1083:
1052:
1019:
992:
959:
924:
813:
802:{\displaystyle t(k)}
784:
683:
642:
631:{\displaystyle \mu }
622:
435:
385:
373:for some polynomial
291:
87:improve this section
3477:Cryptographic nonce
2949:Daniel J. Bernstein
2480:Andrew Chi-Chih Yao
2431:Daniel J. Bernstein
1994:Implementations of
1959:x-logarithm problem
617:negligible function
3583:Subliminal channel
3567:Pseudorandom noise
3514:Key (cryptography)
3334:2008-12-02 at the
3176:The New York Times
3075:The New York Times
2847:van Oorschot, Paul
2317:The New York Times
2021:to ingest entropy.
1779:Entropy extraction
1765:
1738:
1707:
1640:
1572:
1499:
1464:
1382:
1334:
1307:
1223:
1135:
1096:
1065:
1038:
1005:
978:
955:, and the output (
937:
910:
799:
755:
654:
628:
602:
557:
477:
406:
363:
285:asymptotic setting
3764:
3763:
3760:
3759:
3643:Key-based routing
3633:Trapdoor function
3504:Digital signature
3296:. 25 October 2017
2934:978-3-540-67185-5
2894:978-0-7645-4975-5
2595:Dodis, Yevgeniy,
2581:978-0-511-54689-1
2556:978-0-511-54689-1
2523:978-3-540-64265-7
2324:(NSA) inserted a
2239:security strength
1982:Practical schemes
514:
443:
123:
122:
115:
3794:
3750:
3749:
3578:Insecure channel
3414:
3407:
3400:
3391:
3390:
3387:
3386:
3306:
3305:
3303:
3301:
3286:
3280:
3279:
3273:
3261:Matthew D. Green
3253:
3247:
3246:
3234:
3228:
3227:
3219:
3213:
3212:
3210:
3208:
3193:
3187:
3186:
3184:
3182:
3167:
3161:
3160:
3158:
3156:
3141:
3135:
3134:
3132:
3111:
3105:
3104:
3092:
3086:
3085:
3083:
3081:
3072:
3064:
3058:
3057:
3055:
3053:
3048:
3039:
3028:
3027:
3025:
3023:
3018:
3009:
3003:
3002:
3000:
2998:
2993:
2984:
2978:
2977:
2975:
2967:
2961:
2960:
2945:
2939:
2938:
2914:
2905:
2899:
2898:
2874:
2868:
2867:
2859:
2839:
2833:
2832:
2830:
2828:
2813:
2807:
2806:
2799:
2793:
2792:
2785:
2779:
2778:
2775:www.phoronix.com
2767:
2761:
2760:
2753:
2747:
2746:
2738:
2732:
2731:
2729:
2720:
2714:
2713:
2693:
2687:
2686:
2665:John von Neumann
2661:
2655:
2654:
2652:
2651:
2628:
2619:
2613:
2611:
2610:
2608:
2603:
2592:
2586:
2585:, Theorem 3.3.7.
2584:
2567:
2561:
2559:
2542:
2536:
2535:
2507:
2496:
2487:
2477:
2471:
2470:
2446:
2434:
2427:
2218:, is based on a
2171:
2151:Update the seed
2143:
2119:
2065:X9.17 standard (
2034:
1943:Daniel Brown of
1885:, to name a few.
1795:simple algorithm
1791:John von Neumann
1774:
1772:
1771:
1766:
1764:
1763:
1747:
1745:
1744:
1739:
1737:
1736:
1720:
1716:
1714:
1713:
1708:
1685:
1671:
1670:
1661:
1649:
1647:
1646:
1641:
1633:
1625:
1617:
1603:
1602:
1593:
1581:
1579:
1578:
1573:
1562:
1561:
1540:
1539:
1508:
1506:
1505:
1500:
1473:
1471:
1470:
1465:
1463:
1462:
1429:
1428:
1391:
1389:
1388:
1383:
1381:
1380:
1343:
1341:
1340:
1335:
1333:
1332:
1316:
1314:
1313:
1308:
1303:
1302:
1284:
1283:
1265:
1264:
1252:
1251:
1232:
1230:
1229:
1224:
1219:
1218:
1200:
1199:
1181:
1180:
1168:
1167:
1148:
1144:
1142:
1141:
1136:
1134:
1133:
1105:
1103:
1102:
1097:
1095:
1094:
1078:
1074:
1072:
1071:
1066:
1064:
1063:
1047:
1045:
1044:
1039:
1037:
1036:
1014:
1012:
1011:
1006:
1004:
1003:
987:
985:
984:
979:
977:
976:
954:
950:
946:
944:
943:
938:
936:
935:
919:
917:
916:
911:
909:
908:
875:
874:
850:
849:
825:
824:
808:
806:
805:
800:
772:
768:
764:
762:
761:
756:
754:
753:
720:
719:
695:
694:
675:
667:
663:
661:
660:
655:
638:. (The notation
637:
635:
634:
629:
611:
609:
608:
603:
586:
582:
556:
555:
554:
476:
475:
474:
427:
419:
415:
413:
412:
407:
376:
372:
370:
369:
364:
362:
361:
328:
327:
303:
302:
216:randomness tests
166:token generation
118:
111:
107:
104:
98:
67:
59:
3802:
3801:
3797:
3796:
3795:
3793:
3792:
3791:
3767:
3766:
3765:
3756:
3738:
3667:
3423:
3418:
3336:Wayback Machine
3315:
3310:
3309:
3299:
3297:
3288:
3287:
3283:
3271:
3254:
3250:
3235:
3231:
3220:
3216:
3206:
3204:
3194:
3190:
3180:
3178:
3168:
3164:
3154:
3152:
3142:
3138:
3112:
3108:
3097:"Random Number"
3093:
3089:
3079:
3077:
3065:
3061:
3051:
3049:
3046:
3040:
3031:
3021:
3019:
3016:
3010:
3006:
2996:
2994:
2991:
2985:
2981:
2973:
2969:
2968:
2964:
2946:
2942:
2935:
2912:
2906:
2902:
2895:
2875:
2871:
2857:
2851:Vanstone, Scott
2843:Menezes, Alfred
2840:
2836:
2826:
2824:
2815:
2814:
2810:
2801:
2800:
2796:
2787:
2786:
2782:
2769:
2768:
2764:
2755:
2754:
2750:
2739:
2735:
2727:
2721:
2717:
2710:
2694:
2690:
2683:
2662:
2658:
2649:
2647:
2645:
2626:
2620:
2616:
2606:
2604:
2601:
2593:
2589:
2582:
2568:
2564:
2557:
2543:
2539:
2524:
2505:
2497:
2490:
2478:
2474:
2467:
2447:
2443:
2438:
2437:
2428:
2424:
2419:
2403:
2362:
2334:NIST SP 800-90A
2307:
2301:
2296:
2262:
2254:
2207:NIST SP 800-90A
2197:
2175:
2161:
2152:
2133:
2124:
2113:
2104:
2079:keying option 2
2032:
1984:
1914:
1829:
1803:
1787:
1781:
1759:
1755:
1753:
1750:
1749:
1732:
1728:
1726:
1723:
1722:
1718:
1681:
1666:
1662:
1657:
1655:
1652:
1651:
1629:
1621:
1613:
1598:
1594:
1589:
1587:
1584:
1583:
1557:
1553:
1535:
1531:
1514:
1511:
1510:
1479:
1476:
1475:
1449:
1445:
1424:
1420:
1400:
1397:
1396:
1367:
1363:
1349:
1346:
1345:
1328:
1324:
1322:
1319:
1318:
1317:, in which the
1292:
1288:
1279:
1275:
1260:
1256:
1247:
1243:
1238:
1235:
1234:
1208:
1204:
1195:
1191:
1176:
1172:
1163:
1159:
1154:
1151:
1150:
1149:, the sequence
1146:
1145:, then for any
1129:
1125:
1111:
1108:
1107:
1090:
1086:
1084:
1081:
1080:
1076:
1059:
1055:
1053:
1050:
1049:
1026:
1022:
1020:
1017:
1016:
999:
995:
993:
990:
989:
966:
962:
960:
957:
956:
952:
948:
931:
927:
925:
922:
921:
895:
891:
870:
866:
845:
841:
820:
816:
814:
811:
810:
785:
782:
781:
770:
766:
740:
736:
715:
711:
690:
686:
684:
681:
680:
673:
665:
643:
640:
639:
623:
620:
619:
541:
537:
518:
470:
466:
447:
442:
438:
436:
433:
432:
425:
417:
386:
383:
382:
374:
348:
344:
323:
319:
298:
294:
292:
289:
288:
281:
236:
231:polynomial-time
228:
208:
119:
108:
102:
99:
84:
68:
57:
17:
12:
11:
5:
3800:
3790:
3789:
3784:
3779:
3762:
3761:
3758:
3757:
3755:
3754:
3743:
3740:
3739:
3737:
3736:
3731:
3729:Random numbers
3726:
3721:
3716:
3711:
3706:
3701:
3696:
3691:
3686:
3681:
3675:
3673:
3669:
3668:
3666:
3665:
3660:
3655:
3653:Garlic routing
3650:
3645:
3640:
3635:
3630:
3625:
3620:
3615:
3610:
3605:
3600:
3595:
3590:
3585:
3580:
3575:
3573:Secure channel
3570:
3564:
3563:
3562:
3551:
3546:
3541:
3536:
3534:Key stretching
3531:
3526:
3521:
3516:
3511:
3506:
3501:
3500:
3499:
3494:
3484:
3482:Cryptovirology
3479:
3474:
3469:
3467:Cryptocurrency
3464:
3459:
3454:
3453:
3452:
3442:
3437:
3431:
3429:
3425:
3424:
3417:
3416:
3409:
3402:
3394:
3384:
3383:
3378:
3372:
3366:
3360:
3354:
3348:
3343:
3338:
3326:
3314:
3313:External links
3311:
3308:
3307:
3281:
3276:duhkattack.com
3265:Nadia Heninger
3257:Shaanan Cohney
3248:
3229:
3214:
3188:
3162:
3136:
3106:
3087:
3059:
3029:
3004:
2979:
2962:
2951:(2014-02-05).
2940:
2933:
2900:
2893:
2887:. sect 3.5.1.
2869:
2834:
2823:. 5 March 2019
2808:
2794:
2780:
2762:
2748:
2733:
2715:
2708:
2688:
2681:
2673:Pergamon Press
2656:
2643:
2614:
2587:
2580:
2562:
2555:
2537:
2522:
2488:
2472:
2466:978-1584885511
2465:
2440:
2439:
2436:
2435:
2421:
2420:
2418:
2415:
2402:
2399:
2378:cryptographers
2374:Nadia Heninger
2366:Shaanan Cohney
2361:
2358:
2346:Edward Snowden
2303:Main article:
2300:
2297:
2295:
2294:Security flaws
2292:
2291:
2290:
2273:
2272:
2269:
2266:
2260:
2259:
2258:
2252:NSA backdoor.
2228:security level
2211:
2210:
2209:
2204:
2196:
2193:
2177:
2176:
2174:
2173:
2157:
2149:
2129:
2121:
2109:
2101:
2093:
2060:
2048:CryptGenRandom
2044:
2024:
2023:
2022:
2015:
2009:
1983:
1980:
1979:
1978:
1941:
1930:
1919:Blum Blum Shub
1913:
1910:
1909:
1908:
1897:
1886:
1875:
1874:
1873:
1860:
1828:
1825:
1824:
1823:
1817:
1802:
1799:
1793:proved that a
1783:Main article:
1780:
1777:
1762:
1758:
1735:
1731:
1706:
1703:
1700:
1697:
1694:
1691:
1688:
1684:
1680:
1677:
1674:
1669:
1665:
1660:
1639:
1636:
1632:
1628:
1624:
1620:
1616:
1612:
1609:
1606:
1601:
1597:
1592:
1571:
1568:
1565:
1560:
1556:
1552:
1549:
1546:
1543:
1538:
1534:
1530:
1527:
1524:
1521:
1518:
1498:
1495:
1492:
1489:
1486:
1483:
1461:
1458:
1455:
1452:
1448:
1444:
1441:
1438:
1435:
1432:
1427:
1423:
1419:
1416:
1413:
1410:
1407:
1404:
1379:
1376:
1373:
1370:
1366:
1362:
1359:
1356:
1353:
1331:
1327:
1306:
1301:
1298:
1295:
1291:
1287:
1282:
1278:
1274:
1271:
1268:
1263:
1259:
1255:
1250:
1246:
1242:
1222:
1217:
1214:
1211:
1207:
1203:
1198:
1194:
1190:
1187:
1184:
1179:
1175:
1171:
1166:
1162:
1158:
1132:
1128:
1124:
1121:
1118:
1115:
1093:
1089:
1062:
1058:
1035:
1032:
1029:
1025:
1002:
998:
975:
972:
969:
965:
934:
930:
907:
904:
901:
898:
894:
890:
887:
884:
881:
878:
873:
869:
865:
862:
859:
856:
853:
848:
844:
840:
837:
834:
831:
828:
823:
819:
798:
795:
792:
789:
778:forward-secure
752:
749:
746:
743:
739:
735:
732:
729:
726:
723:
718:
714:
710:
707:
704:
701:
698:
693:
689:
653:
650:
647:
627:
613:
612:
601:
598:
595:
592:
589:
585:
581:
578:
575:
572:
569:
566:
563:
560:
553:
550:
547:
544:
540:
536:
533:
530:
527:
524:
521:
517:
513:
510:
507:
504:
501:
498:
495:
492:
489:
486:
483:
480:
473:
469:
465:
462:
459:
456:
453:
450:
446:
441:
405:
402:
399:
396:
393:
390:
360:
357:
354:
351:
347:
343:
340:
337:
334:
331:
326:
322:
318:
315:
312:
309:
306:
301:
297:
280:
277:
254:
253:
252:
251:
244:
243:
242:
234:
226:
207:
204:
169:
168:
163:
150:
145:
140:
138:key generation
121:
120:
71:
69:
62:
56:
53:
15:
9:
6:
4:
3:
2:
3799:
3788:
3785:
3783:
3780:
3778:
3775:
3774:
3772:
3753:
3745:
3744:
3741:
3735:
3734:Steganography
3732:
3730:
3727:
3725:
3722:
3720:
3717:
3715:
3712:
3710:
3707:
3705:
3702:
3700:
3697:
3695:
3692:
3690:
3689:Stream cipher
3687:
3685:
3682:
3680:
3677:
3676:
3674:
3670:
3664:
3661:
3659:
3656:
3654:
3651:
3649:
3648:Onion routing
3646:
3644:
3641:
3639:
3636:
3634:
3631:
3629:
3628:Shared secret
3626:
3624:
3621:
3619:
3616:
3614:
3611:
3609:
3606:
3604:
3601:
3599:
3596:
3594:
3591:
3589:
3586:
3584:
3581:
3579:
3576:
3574:
3571:
3568:
3565:
3560:
3557:
3556:
3555:
3552:
3550:
3547:
3545:
3542:
3540:
3537:
3535:
3532:
3530:
3527:
3525:
3524:Key generator
3522:
3520:
3517:
3515:
3512:
3510:
3507:
3505:
3502:
3498:
3495:
3493:
3490:
3489:
3488:
3487:Hash function
3485:
3483:
3480:
3478:
3475:
3473:
3470:
3468:
3465:
3463:
3462:Cryptanalysis
3460:
3458:
3455:
3451:
3448:
3447:
3446:
3443:
3441:
3438:
3436:
3433:
3432:
3430:
3426:
3422:
3415:
3410:
3408:
3403:
3401:
3396:
3395:
3392:
3388:
3382:
3379:
3376:
3373:
3370:
3367:
3364:
3361:
3358:
3355:
3352:
3349:
3347:
3344:
3342:
3339:
3337:
3333:
3330:
3327:
3324:
3320:
3317:
3316:
3295:
3291:
3285:
3277:
3270:
3266:
3262:
3258:
3252:
3244:
3240:
3233:
3225:
3218:
3203:
3199:
3192:
3177:
3173:
3166:
3151:
3147:
3140:
3131:
3126:
3122:
3118:
3110:
3102:
3098:
3091:
3076:
3071:
3063:
3045:
3038:
3036:
3034:
3015:
3008:
2990:
2983:
2972:
2966:
2959:
2954:
2950:
2944:
2936:
2930:
2926:
2922:
2918:
2911:
2904:
2896:
2890:
2886:
2882:
2881:
2873:
2865:
2864:
2856:
2852:
2848:
2844:
2838:
2822:
2818:
2812:
2804:
2798:
2790:
2784:
2776:
2772:
2766:
2758:
2752:
2744:
2737:
2726:
2719:
2711:
2709:9780123868862
2705:
2701:
2700:
2692:
2684:
2682:0-08-009566-6
2678:
2674:
2670:
2666:
2660:
2646:
2644:0-8186-0591-X
2640:
2636:
2632:
2625:
2618:
2600:
2599:
2591:
2583:
2577:
2573:
2566:
2558:
2552:
2548:
2541:
2533:
2529:
2525:
2519:
2515:
2511:
2504:
2503:
2495:
2493:
2485:
2481:
2476:
2468:
2462:
2458:
2454:
2453:
2445:
2441:
2432:
2426:
2422:
2414:
2412:
2408:
2398:
2396:
2391:
2387:
2383:
2379:
2375:
2371:
2370:Matthew Green
2367:
2357:
2355:
2351:
2350:kleptographic
2347:
2343:
2339:
2335:
2331:
2327:
2323:
2319:
2318:
2313:
2312:
2306:
2288:
2285:
2284:
2283:
2280:
2278:
2270:
2267:
2264:
2263:
2256:
2255:
2253:
2251:
2250:kleptographic
2247:
2242:
2240:
2235:
2231:
2229:
2225:
2221:
2217:
2208:
2205:
2202:
2201:
2200:
2192:
2188:
2186:
2182:
2169:
2165:
2160:
2155:
2150:
2147:
2141:
2137:
2132:
2127:
2122:
2117:
2112:
2107:
2102:
2099:
2095:
2094:
2091:
2088:
2084:
2081:) key bundle
2080:
2076:
2072:
2068:
2064:
2061:
2058:
2054:
2050:
2049:
2045:
2042:
2038:
2030:
2029:
2025:
2020:
2016:
2013:
2010:
2007:
2003:
2000:
1999:
1997:
1993:
1992:
1991:
1989:
1976:
1972:
1968:
1964:
1960:
1956:
1955:
1950:
1946:
1942:
1939:
1935:
1931:
1928:
1924:
1920:
1916:
1915:
1906:
1902:
1898:
1895:
1891:
1887:
1884:
1880:
1876:
1870:
1865:
1861:
1858:
1854:
1853:
1851:
1847:
1843:
1839:
1835:
1831:
1830:
1822:
1818:
1816:
1812:
1808:
1807:
1806:
1798:
1796:
1792:
1786:
1776:
1760:
1756:
1733:
1729:
1704:
1701:
1695:
1689:
1686:
1675:
1667:
1663:
1637:
1634:
1626:
1618:
1607:
1599:
1595:
1566:
1558:
1554:
1544:
1536:
1532:
1528:
1522:
1516:
1496:
1493:
1487:
1481:
1456:
1450:
1442:
1439:
1436:
1425:
1417:
1414:
1411:
1405:
1402:
1393:
1374:
1368:
1360:
1357:
1354:
1329:
1325:
1299:
1296:
1293:
1289:
1285:
1280:
1276:
1272:
1269:
1266:
1261:
1257:
1253:
1248:
1244:
1215:
1212:
1209:
1205:
1201:
1196:
1192:
1188:
1185:
1182:
1177:
1173:
1169:
1164:
1160:
1130:
1122:
1119:
1116:
1091:
1087:
1060:
1056:
1033:
1030:
1027:
1023:
1000:
996:
973:
970:
967:
963:
932:
928:
902:
896:
888:
885:
882:
876:
871:
863:
860:
857:
846:
838:
835:
832:
826:
821:
817:
793:
787:
779:
774:
747:
741:
733:
730:
727:
716:
708:
705:
702:
696:
691:
687:
677:
671:
651:
645:
625:
618:
596:
590:
587:
583:
576:
573:
567:
561:
548:
542:
534:
531:
528:
519:
511:
505:
502:
493:
487:
481:
471:
463:
460:
457:
448:
439:
431:
430:
429:
423:
403:
400:
394:
388:
380:
355:
349:
341:
338:
335:
324:
316:
313:
310:
304:
299:
295:
286:
276:
274:
273:cryptanalysis
269:
265:
263:
262:normal number
259:
248:
247:
245:
240:
232:
224:
223:next-bit test
220:
219:
217:
213:
212:
211:
203:
201:
196:
194:
190:
189:one-time pads
186:
182:
178:
174:
167:
164:
162:
158:
154:
151:
149:
146:
144:
141:
139:
136:
135:
134:
132:
128:
117:
114:
106:
96:
92:
88:
82:
81:
77:
72:This section
70:
66:
61:
60:
52:
50:
46:
42:
38:
34:
30:
26:
22:
3728:
3684:Block cipher
3558:
3529:Key schedule
3519:Key exchange
3509:Kleptography
3472:Cryptosystem
3421:Cryptography
3298:. Retrieved
3294:slashdot.org
3293:
3284:
3275:
3251:
3242:
3232:
3217:
3205:. Retrieved
3201:
3191:
3179:. Retrieved
3175:
3165:
3153:. Retrieved
3150:The Guardian
3149:
3139:
3120:
3109:
3100:
3090:
3080:November 19,
3078:. Retrieved
3074:
3062:
3052:November 19,
3050:. Retrieved
3022:November 19,
3020:. Retrieved
3007:
2997:November 19,
2995:. Retrieved
2982:
2971:"FIPS 186-4"
2965:
2956:
2943:
2916:
2903:
2879:
2872:
2866:. CRC Press.
2862:
2837:
2825:. Retrieved
2820:
2811:
2797:
2783:
2774:
2765:
2751:
2736:
2718:
2698:
2691:
2668:
2659:
2648:. Retrieved
2630:
2617:
2605:, retrieved
2597:
2590:
2571:
2565:
2560:, def 3.3.1.
2546:
2540:
2501:
2475:
2451:
2444:
2425:
2407:World War II
2404:
2363:
2354:RSA Security
2342:The Guardian
2341:
2338:Dual EC DRBG
2315:
2311:The Guardian
2309:
2308:
2305:Dual_EC_DRBG
2286:
2281:
2274:
2246:Dual EC DRBG
2243:
2236:
2232:
2224:counter mode
2220:block cipher
2213:
2198:
2189:
2184:
2178:
2167:
2163:
2158:
2153:
2146:exclusive or
2139:
2135:
2130:
2125:
2115:
2110:
2105:
2097:
2089:
2082:
2066:
2046:
2026:
1985:
1974:
1970:
1966:
1962:
1958:
1952:
1949:Dual EC DRBG
1863:
1838:counter mode
1834:block cipher
1804:
1788:
1394:
947:with length
777:
775:
678:
614:
282:
270:
266:
255:
209:
206:Requirements
197:
170:
124:
109:
100:
85:Please help
73:
48:
44:
41:cryptography
32:
28:
24:
20:
18:
3672:Mathematics
3663:Mix network
3207:7 September
3181:7 September
3155:7 September
3101:CSRC | NIST
2821:FreeBSD.org
2360:DUHK attack
2222:running in
2087:random seed
2033:/dev/random
1996:/dev/random
1582:, in which
664:means that
279:Definitions
3771:Categories
3623:Ciphertext
3593:Decryption
3588:Encryption
3549:Ransomware
3300:25 October
2650:2006-11-29
2417:References
2332:(PRNG) of
2203:FIPS 186-4
2051:, part of
2028:arc4random
1961:, and the
1075:of period
809:is a PRNG
668:is chosen
239:Andrew Yao
161:RSASSA-PSS
55:Background
3613:Plaintext
2827:24 August
2607:3 January
2532:0302-9743
2195:Standards
2057:CryptoAPI
2053:Microsoft
1905:HMAC_DRBG
1894:Hash_DRBG
1832:A secure
1702:−
1551:‖
1494:−
1431:→
1406::
1395:Any PRNG
1270:…
1186:…
877:×
852:→
827::
722:→
697::
670:uniformly
649:←
626:μ
615:for some
591:μ
523:←
512:−
452:←
330:→
305::
177:protocols
103:June 2024
74:does not
3752:Category
3658:Kademlia
3618:Codetext
3561:(CSPRNG)
3332:Archived
2958:argument
2853:(1996).
2612:, def 4.
2326:backdoor
2216:CTR_DRBG
2041:ChaCha20
1945:Certicom
1883:ChaCha20
1846:CTR_DRBG
416:for any
175:in some
129:require
3428:General
3243:Reuters
2405:During
2380:at the
2328:into a
2019:BLAKE2s
2012:Fortuna
1852:(AES).
1811:ciphers
1801:Designs
1717:; then
377:, is a
283:In the
185:entropy
95:removed
80:sources
35:) is a
3539:Keygen
3321:
2931:
2891:
2706:
2679:
2641:
2578:
2553:
2530:
2520:
2463:
2372:, and
2156:= TDEA
2128:= TDEA
2108:= TDEA
2002:Yarrow
1967:outlen
1957:, the
1881:, and
191:, the
148:nonces
131:random
25:CSPRNG
3569:(PRN)
3272:(PDF)
3202:Wired
3047:(PDF)
3017:(PDF)
2992:(PDF)
2974:(PDF)
2913:(PDF)
2858:(PDF)
2728:(PDF)
2627:(PDF)
2602:(PDF)
2506:(PDF)
2006:macOS
1879:ISAAC
1864:after
173:nonce
157:ECDSA
153:salts
125:Most
33:CPRNG
27:) or
3323:4086
3302:2017
3209:2013
3183:2013
3157:2013
3121:NIST
3082:2016
3054:2016
3024:2016
2999:2016
2929:ISBN
2889:ISBN
2829:2019
2704:ISBN
2677:ISBN
2639:ISBN
2609:2016
2576:ISBN
2551:ISBN
2528:ISSN
2518:ISBN
2461:ISBN
2390:WPA2
2384:and
2314:and
2277:NIST
2075:TDEA
2071:FIPS
2063:ANSI
1988:seed
1973:and
1932:The
1917:The
1901:HMAC
1890:hash
1855:AES-
1842:NIST
1821:hard
1813:and
1650:and
588:<
401:>
159:and
78:any
76:cite
49:CRNG
3319:RFC
3125:doi
2921:doi
2510:doi
2344:by
2181:AES
2055:'s
2037:RC4
1899:An
1857:CTR
676:.)
200:API
181:key
89:by
51:).
3773::
3292:.
3274:.
3267:.
3263:;
3259:;
3241:.
3200:.
3174:.
3148:.
3123:.
3119:.
3099:.
3073:.
3032:^
2955:.
2927:.
2915:.
2883:.
2860:.
2849:;
2845:;
2819:.
2773:.
2671:.
2633:.
2629:.
2526:.
2516:.
2491:^
2482:.
2459:.
2457:70
2376:,
2368:,
2279:.
2166:⊕
2138:⊕
2043:.
1392:.
988:,
776:A
765:,
516:Pr
445:Pr
275:.
258:pi
218::
19:A
3413:e
3406:t
3399:v
3304:.
3278:.
3245:.
3226:.
3211:.
3185:.
3159:.
3127::
3103:.
3084:.
3056:.
3026:.
3001:.
2976:.
2937:.
2923::
2897:.
2831:.
2777:.
2745:.
2730:.
2712:.
2685:.
2653:.
2534:.
2512::
2469:.
2433:.
2185:k
2172:.
2170:)
2168:t
2164:x
2162:(
2159:k
2154:s
2148:.
2142:)
2140:t
2136:s
2134:(
2131:k
2126:x
2120:.
2118:)
2116:D
2114:(
2111:k
2106:t
2098:D
2090:s
2083:k
2077:(
1975:Q
1971:P
1907:.
1896:.
1761:1
1757:G
1734:0
1730:G
1719:G
1705:k
1699:)
1696:k
1693:(
1690:p
1687:=
1683:|
1679:)
1676:s
1673:(
1668:1
1664:G
1659:|
1638:k
1635:=
1631:|
1627:s
1623:|
1619:=
1615:|
1611:)
1608:s
1605:(
1600:0
1596:G
1591:|
1570:)
1567:s
1564:(
1559:1
1555:G
1548:)
1545:s
1542:(
1537:0
1533:G
1529:=
1526:)
1523:s
1520:(
1517:G
1497:k
1491:)
1488:k
1485:(
1482:p
1460:)
1457:k
1454:(
1451:p
1447:}
1443:1
1440:,
1437:0
1434:{
1426:k
1422:}
1418:1
1415:,
1412:0
1409:{
1403:G
1378:)
1375:k
1372:(
1369:t
1365:}
1361:1
1358:,
1355:0
1352:{
1330:i
1326:r
1305:)
1300:1
1297:+
1294:i
1290:s
1286:,
1281:i
1277:r
1273:,
1267:,
1262:2
1258:r
1254:,
1249:1
1245:r
1241:(
1221:)
1216:1
1213:+
1210:i
1206:s
1202:,
1197:i
1193:y
1189:,
1183:,
1178:2
1174:y
1170:,
1165:1
1161:y
1157:(
1147:i
1131:k
1127:}
1123:1
1120:,
1117:0
1114:{
1092:1
1088:s
1077:i
1061:i
1057:y
1034:1
1031:+
1028:i
1024:s
1001:i
997:y
974:1
971:+
968:i
964:s
953:i
949:k
933:i
929:s
906:)
903:k
900:(
897:t
893:}
889:1
886:,
883:0
880:{
872:k
868:}
864:1
861:,
858:0
855:{
847:k
843:}
839:1
836:,
833:0
830:{
822:k
818:G
797:)
794:k
791:(
788:t
771:G
767:G
751:)
748:k
745:(
742:p
738:}
734:1
731:,
728:0
725:{
717:k
713:}
709:1
706:,
703:0
700:{
692:k
688:G
674:X
666:x
652:X
646:x
600:)
597:k
594:(
584:|
580:]
577:1
574:=
571:)
568:r
565:(
562:A
559:[
552:)
549:k
546:(
543:p
539:}
535:1
532:,
529:0
526:{
520:r
509:]
506:1
503:=
500:)
497:)
494:x
491:(
488:G
485:(
482:A
479:[
472:k
468:}
464:1
461:,
458:0
455:{
449:x
440:|
426:A
418:k
404:k
398:)
395:k
392:(
389:p
375:p
359:)
356:k
353:(
350:p
346:}
342:1
339:,
336:0
333:{
325:k
321:}
317:1
314:,
311:0
308:{
300:k
296:G
235:k
227:k
116:)
110:(
105:)
101:(
97:.
83:.
47:(
31:(
23:(
Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.
