0

I want to research pseudo random number generators, and I see that a lot of the random number generators are not as secure as people assume.

What I would like to know is what are the most widely used random generators currently ? Be it PRNG or CSPRNG. This is under my assumption that TRNG has not yet become as common as the former generators. I would like to understand how frequently PRNGs are used in security applications, when CSPRNGs should have been used instead.

  • 1
    Are non-cryptographic random number generators security-related? This sounds like it might be better for StackOverflow. – Macil Oct 5 '17 at 22:15
  • I would say insecure random generators touches the security field. The question however does not seem to be. – Dog eat cat world Oct 5 '17 at 22:29
  • To be specific - I want to know if non secure PRNG are used widely which in turn will have a hit on security. It is just my thought. If it is not valid then i could just close the question. Sorry new to this section. – C0d3ine Oct 5 '17 at 22:47
  • 1
    "widely used" will be difficult to define because you can never be assured of a statistically complete sample set. It would be up to guesses or personal experience. The other issue is that you would have to confirm that a widely used RNG is being used for security. This question is one of those situations where the answers might imply a security impact, but the question itself is not about security. – schroeder Oct 6 '17 at 9:07
1

Mersenne Twister is a non-cryptographic RNG that's commonly used in many applications. According to Wikipedia:

The Mersenne Twister is the default PRNG for the following software systems:

Microsoft Visual C++,[3] Microsoft Excel,[4] GAUSS,[5] GLib,[6] GNU Multiple Precision Arithmetic Library,[7] GNU Octave,[8] GNU Scientific Library,[9] gretl,[10] IDL,[11] Julia,[12] CMU Common Lisp,[13] Embeddable Common Lisp,[14] Steel Bank Common Lisp,[15] Maple,[16] MATLAB,[17] Free Pascal,[18] PHP,[19] Python,[20][21] R,[22] Ruby,[23] SageMath,[24] Scilab,[25] Stata.[26] It is also available in Apache Commons,[27] in standard C++ (since C++11),[28][29] and in Mathematica.[30] Add-on implementations are provided in many program libraries, including the Boost C++ Libraries,[31] the CUDA Library,[32] and the NAG Numerical Library.[33]

Mersenne Twister is a very good PRNG, with good statistical properties, very long period, and is fast. Despite being a very good PRNG, and is widely used for many games, statistical simulations, and other purposes, it's not suitable for cryptography.

Another common RNG is linear congruential generator (LCG), which for a long time is the default RNG in popular C libraries (and many other languages that uses C library, such as PHP). LCG is a simple but very poor RNG, even for non-cryptographic RNG standards. Its period size is embarrassingly small, already-produced numbers cannot repeat for the entire period, and it has statistical properties that makes it unsuitable for many purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.