Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the common tools and methods used for analyzing and attacking Random Number Generators?

I know what characteristics make a good RNG and what a good RNG should do but I do not know how to analyze a RNG when I treat it like a black-box.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

The generic tests for randomness are the "Diehard suite", but they don't ensure security. These are tests which detect biases in PRNG output. Security is about defeating intelligent attackers who know the internal details of the software you use and can think a lot; statistical tests are mindless automaton which just find the most blatant deviations from pure randomness. So if a statistical suite like the Diehard tests finds something weird with your RNG, then the PRNG is definitely bad; but if the tests find nothing, then you just don't know whether the PRNG is good or not.

A "black box" is the conceptual representation of a completely unknown algorithm. This does not occur often in practice; arguably, it never occurs. The algorithm implemented by a "black box" is always known or potentially known, if only by identifying the developer and raiding his drawers one night. That's more or less the idea behind Kerckhoffs's principle. Since the "ideal black box situation" does not occur in practice, there is no "commonly applied methodology". Or, if you prefer, the commonly applied methodology against black boxes is to open the box so that it ceases to be black.

A well-documented historical example is the cryptanalysis of the Enigma. The Polish cryptographers who broke the first military versions made a lot of guessing, but also knew the "commercial" versions from which the military Enigma was derived, and this helped them a lot. During the course of the War, considerable effort was devoted to the capture of actual machines and keys -- that's the "open the box" analogy, and it worked.

share|improve this answer
    
Interesting as always. Thanks. Looks like I have some reading to do! –  Rell3oT Mar 25 '13 at 23:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.