1

I am interested in understanding if it is possible to predict Python 3 random.random() when seeded with high entropy value from a physical system, like a dice toss.

In other words, is random.random() a good function that takes "entropy" and reduces it to an unpredictable determinist bounded value or not?

From my understanding, it passes all randomness tests I found.

I am not interested in good practice and that it is better to use /dev/urandom, secrets or other sources of good random values. That is a known fact.

Things to consider:

  • The random generator is seeded with high entropy value and only used once to generate a single value from the initial state before being seeded again.
  • The generator is seeded with new seed for every number.
  • The seed has high entropy, something around 256 bits or entropy or more.

The reason I want to do this it that it allows me to use random.choise which is an extremely convenient way to transform a seed into a choice. Here's a rough implementation of the idea:

  1. random.random is seeded with an high entropy seed.
  2. random.choice is used.
  3. random.random is seeded with a new high entropy seed.
  4. random.choice is used.
  5. ...again and again.

Is the resulting choices list predictable?

Improve this question
4
  • This has already been answered at stackoverflow.com/questions/2145510/…
    – forest
    Dec 12, 2017 at 14:27
  • This question is not about repeated values output at all. I hope I made the post clearer in my last edit. And not about the birthday paradox. Thank you for your comments!
    – PyWebDesign
    Dec 12, 2017 at 14:56
  • 5
    This question looks kind of useless for me. Why would you seed the random generator from a good random source and then draw a single value from it instead of just taking the random seed value directly? Can you please show the use case behind the question?
    – Steffen Ullrich
    Dec 12, 2017 at 15:18
  • Just because random.choice which exist on top of random.random, which take a choice of a list with pseudo random, is an extremely convenient way to transform a seed into a choice. It is more about understanding and learning for me tough
    – PyWebDesign
    Dec 12, 2017 at 15:23

2 Answers 2

Reset to default
3

If you reseed it after every time you draw a number, it will be as safe as whatever you reseed it with. Think of it like this. Your seed source generates a series of numbers xi. You run these through Pythons random number generator, essentialy generating a new series of numbers f(xi). Given that f doesen't scew the distribution (and a random number generator shouldn't), you will just have applied a pretty pointless transform.

This doesn't mean that what you are doing is a good idea. It looks like an ugly hack to me. Ugly hacks introduces complexities that can lead to mistakes that can lead to vulnerabilities. If I were you, I would just write my own securePick method and use that. It shouldn't take many lines of code.

Improve this answer
0
2

Is it possible to predict python's random.random() numbers? If you have access to the machine, it's deterministic and absolutely possible. That's true of all pseudo random number generators.

Can you predict the next number based on previous numbers. In theory, any pseudo random number generator can be figured out from the outside looking in, although in practice, a strong pseudo random number generator will take a very impractical amount of time.

Even if reseeded every time it's used, if the way it is reseeded is not truly random, then it is still a pseudo number generator and all the above statements are still true.

If it's seeded with a true random number, you should use the real random number generator and avoid the pseudo number generator all together.

If you did pass true random numbers to seed the random number generator, would the result be random? That's an interesting question. It'd depend on the implementation. If the implementation was to just use the seed as the random number, and the seed was a true random number that was constantly reseeded, then yes, it would be random. In most cases I'd guess, passing a true random number into a pseudo random number generator would make the number pseudo random. That's my educated guess at least, that particular question would be more ideal for cryptography experts rather than security experts. It's an interesting question, but again, not practical in any way I could think of.

I can't speak too much about how strong python random.random() is, but the python documentation for random states:

The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator.

The short answer is yes, it's possible. random.random() specifically appears that it is used for randomness, not security, so use it accordingly.

Improve this answer
4
  • the question asks for if this is true if the generator is reseeded with high entropy value between every number generation.
    – PyWebDesign
    Dec 12, 2017 at 15:14
  • @PyWebDesign I see your edits clarify this. Good question, I've edited my answer to address this, see paragraph 3 (edited it again)
    – Goose
    Dec 12, 2017 at 15:18
  • you are probably right about just using the seed directly. It is however very convenient for user random.choice to take a single item in a list using some entropy seed. How I see it, the random.choice when seeded between choices, is a convenient function that takes a seed and converts it to a choice without gaining predictability. Does it ONLY depend on the quality of the seed?
    – PyWebDesign
    Dec 12, 2017 at 15:21
  • @PyWebDesign I made another edit (currently paragraph 5) that attempts to address the trickier question of using true random numbers as seeds in a pseudo random number generator. It's a challenging question, but I think this answer is pretty accurate. Hopefully someone gives a second opinion.
    – Goose
    Dec 12, 2017 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .