Is a concatenation of random numbers better than a single random number?

Question

We are generating random numbers 16 digits in length. One option that was put forward was to generate four random numbers of 4 digits each and concatenate them instead of just generating a single 16 digit random number. The reason accompanying the suggestion was that it would be harder to predict the next number in case there was an issue with the random number generator.

So is the concatenated random number better than a single random number?

Answer 1

So is the concatenated random number better than a single random number?

If the random generator really produces random data then it will not matter.

... it would be harder to predict the next number in case there was an issue with the random number generator.

If the issue is that the random generator is not that random at all then it might even be better for an attacker to get as much last outputs as possible because then the behavior could be better to predict. Of course this assumption depends highly on the internals of the random generator, so no general answer is possible.

But in general: if you need really good random data you should use a proper random generator. Your method will not improve the quality of the output if the random generator is bad, i.e it stays predictable. If you actually don't need true random data but only want to make sure that you get somewhat random data without a bias you should be careful because depending on how exactly you do it your method might add a bias to the output.

Answer 2

This presentation about the concept of an unpredictable pseudo stream can help to clarify the ideas: https://class.coursera.org/crypto-preview/lecture/5 presentation in PDF http://spark-university.s3.amazonaws.com/stanford-crypto/slides/02.2-stream-annotated.pdf

An pseudorandom steam is unpredicatable, when no attacker can guess correctly the next content of the stream knowning the previous content, with probability larger than the random choice (1/2^(number of bits)) and reasonsable time.

Therefore, if you use any secure pseudorandom stream, such as Chacha20 (the pseudorandom stream is the stream used in this cipher to XOR the data), then by definition, the bytes are unpredictable. Otherwise, it would be a significant security breach in these stream ciphers.

Answer 3

Typically combining consecutive results from the same pseudorandom number generator is inferior to using a single result. Think of it this way: the random number generator generates a certain number of results before cycling back to the first number it provided. If you use up four results at a time, there are only one quarter as many results that you can get - assuming that the possible number of results is a multiple of four, which is likely on a binary machine - so a brute force attack would only take one quarter as long to break your data.

In addition, the behavior of the data itself may be problematic when you combine consecutive results. For example, many random number generators provide individual numbers which have good statistical distributions, but this doesn't necessarily apply to combinations of consecutive numbers, where the random number generator may be more or less likely to generate runs of similar results than would a truly random source. For example, I once used a random number generator to simulate rolls of a six sided die, and when I summed three consecutive results, the behavior of consecutive results was such that I never got a sum of 18, over many thousand attempts.

I discuss consecutive results, but these arguments apply to use of nonconsecutive results as well when they are selected in a systematic way. Your best bet is just to select a better random number generator and use the results one at a time. The only time when you need to combine multiple results is when a single result doesn't have enough bits to satisfy your needs - rare with off the shelf pseudorandom number generators.