I'm creating a quantum random number generator as part of my thesis.

As part of the research phase, I'm trying to substantiate my aspertion that encryption is significantly weakened if a computer system has poor entropy available to it.

However, I can't seem to find any specific attacks that exploit this weakness.

Does anyone know of any specific attacks, theoretical or implemented, that I can read up on?


One notorious PRNG attack was the attack on the PRNG that was used for SSL in early versions of Netscape, as published in this paper written in 1996 by two PhD students at Berkeley. As explained in the paper, the PRNG relied on three sources of 'entropy': the time of day, the process ID, and the parent process ID.

  1. Netscape Navigator 1.1 1996

    Ian Goldberg and David Wagner found out that Netscape Navigator 1.1 was using only three sources to seed their pseudo-random number generator (PRNG). The three sources were: the time of day, the process id, and the parent process id. They showed, these “random” sources aren’t that random and were relatively easy to figure out.

  2. Debain 2008

    DSA-1571-1 openssl -- predictable random number generator

    Luciano Bello discovered that the random number generator in Debian's openssl package is predictable. This is caused by an incorrect Debian-specific change to the openssl package (CVE-2008-0166). As a result, cryptographic key material may be guessable.

    And from Lessons from the Debian/OpenSSL Fiasco

    they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767 different possible SSH keys of a given type and size, so there are a lot of people walking around with the same keys.

    XKCD for this is 424 and see Bruce Schneier's blog on this

  3. RSA Weak Keys 2012

    Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices

    We performed a large-scale study of RSA and DSA cryptographic keys in use on the Internet and discovered that significant numbers of keys are insecure due to insufficient randomness. These keys are being used to secure TLS (HTTPS) and SSH connections for hundreds of thousands of hosts.

    and a related question for this in Cryptography.SE

  4. 2016 Software vulnerabilities in the Brazilian voting machine

    Aranha et. al Software vulnerabilities in the Brazilian voting machine - Usenix

    • Weak PRNG
    • Choice of seed not truly random
    • Seed made public
  5. 2013 RSA: Citizen Digital Certificate of Taiwan

    The random numbers generated by the batch of problematic cards obviously do not meet even minimal standards for collecting and processing entropy. This is a fatal flaw, and it can be expected to continue causing problems until all of the vulnerable cards are replaced.

    The researchers investigate Taiwan’s national “Citizen Digital Certificate” database that contains more than two million RSA modulus. They have efficiently factored 184 distinct RSA keys. They are noticed that some of the primes occur more than was like p110 occurs 46-times. The reason was the flawed random-number generators in some of the smart cards.

    This contains failed hardware and collecting and processing entropy.

  6. Yubico 2019

    Security advisory YSA-2019-02 – reduced initial randomness on FIPS keys

    An issue exists in the YubiKey FIPS Series devices with firmware version 4.4.2 or 4.4.4 (there is no released firmware version 4.4.3) where random values leveraged in some YubiKey FIPS applications contain reduced randomness for the first operations performed after YubiKey FIPS power-up. The buffer holding random values contains some predictable content left over from the FIPS power-up self-tests which could affect cryptographic operations which require random data until the predictable content is exhausted.

    In ECDSA signature this is catastrophic since the bias can be exploitable to signature forgeries. Even one-bit bias in the nonce can be exploitable.

    More details in the links.

  • Thanks to Squeamish Ossifrage for pointing this. SO turn back to normal so that they can contribute! – kelalaka Oct 10 '20 at 15:30
  • Can you elaborate on "They are noticed that some of the primes occur more than was like p110 occurs 46-times". Seems to me like a sentence produced by a random word generator. – lab9 Oct 10 '20 at 20:16
  • No, in their work the named the primes, that's it. See the slides – kelalaka Oct 10 '20 at 20:19

There was an opensource ransomware named HiddenTear that created a random encryption key, but the key used Environment.TickCount as the seed, making it trivial to bruteforce the key.

It also created a version.txt file containing the encrypted computer name. So to break it you would use a ballpark estimate of how long the computer was running when the malware activated by reading the Created at attribute of an encrypted file, and creating random keys to decrypt version.txt. As soon as the value decrypted matched the computer name, you had the key.


Don't forget that entropy alone is not sufficient.

Most random number generators are pseudo random number generators. A source may produce high entropy number sequences but if the sequence is predictable enough it fails as a good random source. A classic example of this would be the digits of π (pi). The sequence has high entropy but is readily determined.


The k parameter in elliptic-curve cryptography is supposed to be a secret value that is never reused, and it's usually obtained from a random number generator. Two high-profile hacks that were possible due to not using secure random numbers for it:

  1. It led to the PlayStation 3's private key being leaked
  2. Many Bitcoin apps on Android lost the contents of their wallets

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.