2

I've have a question on the PRNG in OpenSSL.

I would like to understand how do you evaluate the diversity/entropy of the PRNG used in the OpenSSL (Cryptographic Library).

If this is the wrong forum, do point me to the right one.

Thank you.

  • If not a dupe, the question seems fine. – Maarten Bodewes Apr 17 '15 at 2:19
1

Although there are no guarantees, there are mathematical safety-measures against poor keys due to inappropriate random number generators. You could for example try some nice software tools to test the statistical entropy that your generator puts out:

These tools come with a large number of statistical tests, but as RFC 4086 states:

Statistically tested randomness in the traditional sense is NOT the same as the unpredictability required for security use.

Then it lists some acceptable sources and algorithms for generating entropy, but never provides a way to verify output, perhaps insinuating that that is not possible to test unpredictability.

That said, RFC 4086 was published in 2005, TestU01 has received updates until in 2009, and Dieharder was still active in 2013. Since the text was published, the differences between Shannon- (traditional) and minimum- (crypto) entropy have been kept into consideration by all serious cryptographers, so although I haven't tried these packages myself, they will in all likelyhood account for this in their tests. They are also both recommended by the NIST, even when they took down their own statistical tests.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.