I've have a question on the PRNG in OpenSSL.
I would like to understand how do you evaluate the diversity/entropy of the PRNG used in the OpenSSL (Cryptographic Library).
If this is the wrong forum, do point me to the right one.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Although there are no guarantees, there are mathematical safety-measures against poor keys due to inappropriate random number generators. You could for example try some nice software tools to test the statistical entropy that your generator puts out:
These tools come with a large number of statistical tests, but as RFC 4086 states:
Statistically tested randomness in the traditional sense is NOT the same as the unpredictability required for security use.
Then it lists some acceptable sources and algorithms for generating entropy, but never provides a way to verify output, perhaps insinuating that that is not possible to test unpredictability.
That said, RFC 4086 was published in 2005, TestU01 has received updates until in 2009, and Dieharder was still active in 2013. Since the text was published, the differences between Shannon- (traditional) and minimum- (crypto) entropy have been kept into consideration by all serious cryptographers, so although I haven't tried these packages myself, they will in all likelyhood account for this in their tests. They are also both recommended by the NIST, even when they took down their own statistical tests.