Re: [TLS] RNG vs. PRNG

[Martin Rex <[e-mail]>]

Dean Anderson wrote:
> 
> > > True RNG "itself" can't be attacked - though its implementations could
> > > (depending on many circumstances). Attacks against PRNG could be both
> > > cryptanalytic and implementation-directed.
> > 
> > A true RNG depends on physical processes.  Therefore it can be attacked
> > by physical means.  

True RNG values can not be attacked by "guessing" them.
But it is likely possible to make a RNG produce less output values
or output values with less entropy.

Possibilities to collect "true RNG values" is measuring
thermal noise.  While it may appear difficult to influence the
actual physical process, it is usually much easier to impact
the sensor that "measures" the physical process.

A potential means to make an RNG based on thermal noise produce
less entropy is cooling the entire device down.

But maybe it is also possible to trick the sensor, either with an
strong RF signal using a constant-fequency sine wave (contact-less)
or by ultra-sonic motions (i.e with contact).

> 
> 
> > The simplest thing to do is to couple an RNG to a PRNG.
> 
> No. A PRNG only generates a subset of the input: equal in size to the
> size of the seed. PRNGs reduce entropy to the size of the seed. 

I don't think that is generally true.

This would imply that the size of the "loop" depends on the amount
of entropy in the seed -- which is probably wrong.

A PRNG is by design limited to a certain number of internal
states (e.g. size of the entropy pool), and there is a deterministic
correlation between the PRNG output values and the PRNG internal state.

Usually PRNGs modify their internal state each time that a PRNG output
value is requested.

Leaving re-seeding aside, when requesting enough output values,
at some point the output values will start repeating.

Let's say you use a PRNG with 256-bit of internal state.

If you're lucky, and your PRNG has only one single loop, then
output values will repeat after 2^256 extractions.  The seed will
only determine where on this single loop you start.

But if your PRNG has 2^128 loops of length 2^128, then your output
values will start repeating after 2^128 extractions.  The seed will
determine on which of the 2^128 loops you start, but it will not
affect that your output values repeat after 2^128 extractions.


-Martin