15
$\begingroup$

I am interested in generation of pseudo-random numbers for cryptography. Besides Chapter 5 of Menezes/Oorschot/Vanstone; Chapter 8 of Stinson; and Chapter 3 of Goldreich, where else could I find more? I'm interested in general principles for designing PRNGs (desirable properties, tests, etc).

$\endgroup$
  • 3
    $\begingroup$ Not on design per se, but you may be interested in Goldreich's newer book: books.google.com/books?id=9k6Lw2U2XCkC $\endgroup$ – S Huntsman Dec 11 '10 at 16:07
  • $\begingroup$ @S Huntsman: thanks a lot for that! I didn't know Goldreich had a book on PRNGs. $\endgroup$ – Jay Dec 11 '10 at 16:10
8
$\begingroup$

You might want to check out

$\endgroup$
  • 1
    $\begingroup$ Most of this is not very relevant to practical implementations of PRNGs for cryptography. This is not a good set of resources to give an implementor. $\endgroup$ – D.W. May 11 '11 at 9:01
4
$\begingroup$

If you are thinking of implementing your ideas, there is a standard battery of tests that PRNG implementations are given. These tests (DIEHARD and successor DIEHARDER) may be downloaded from its archived webpage and http://www.phy.duke.edu/~rgb/General/dieharder.php respectively.

$\endgroup$
  • 4
    $\begingroup$ Important cautionary note: passing DIEHARD does not mean your PRNG is any good. This is not a resource I would give to an implementor who needs to implement a secure PRNG. $\endgroup$ – D.W. May 11 '11 at 9:02
1
$\begingroup$

Are you interested in implementing a PRNG? If so, your best bet is not to design one yourself, but just use a standard one. /dev/urandom is the right answer on most platforms. If /dev/urandom doesn't exist, generating a random AES key with /dev/random and then running AES-CTR mode to generate lots of pseudorandom numbers is another reasonable approach.

I recommend that you read Cryptography Engineering, by Ferguson, Schneier, and Kohno. It is an excellent book. It will teach you a lot about how to design and build real cryptosystems.

If you actually have to build a system that will be deployed in practice, I recommend that you do not take your guidance from the theoretical CS community, but rather from the community of practitioners and practice-oriented researchers. Much of the theoretical CS work will not be very relevant, or potentially even misleading, to practical implementation of a secure PRNG. I also encourage you to look at the IT Security stack exchange for those kinds of questions.

$\endgroup$
  • 4
    $\begingroup$ The question explicitly says he is interested in general principles, and the question was asked on the Theoretical CS stack exchange... $\endgroup$ – David Cash May 12 '11 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.