Re: [TLS] RNG vs. PRNG

"Kemp, David P." <DPKemp@missi.ncsc.mil> Wed, 05 May 2010 13:10 UTC

Return-Path: <DPKemp@missi.ncsc.mil>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0B2C53A6BFA for <tls@core3.amsl.com>; Wed, 5 May 2010 06:10:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.184
X-Spam-Level:
X-Spam-Status: No, score=-4.184 tagged_above=-999 required=5 tests=[AWL=-0.185, BAYES_50=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kY6e-k-DOSxl for <tls@core3.amsl.com>; Wed, 5 May 2010 06:10:20 -0700 (PDT)
Received: from stingray.missi.ncsc.mil (stingray.missi.ncsc.mil [144.51.50.20]) by core3.amsl.com (Postfix) with ESMTP id AA00A3A6B5B for <tls@ietf.org>; Wed, 5 May 2010 06:10:19 -0700 (PDT)
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
Date: Wed, 5 May 2010 09:09:36 -0400
Message-ID: <201005051310.o45D9usV021739@stingray.missi.ncsc.mil>
In-Reply-To: <Pine.LNX.4.44.1005042046390.29670-100000@citation2.av8.net>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [TLS] RNG vs. PRNG
Thread-Index: Acrr773tPJhaLpptSp6JHPlH5/gjVgAYZwBQ
References: <A059CB15-9776-4711-8F79-94C6C76231B0@cs.columbia.edu> <Pine.LNX.4.44.1005042046390.29670-100000@citation2.av8.net>
From: "Kemp, David P." <DPKemp@missi.ncsc.mil>
To: <tls@ietf.org>
X-OriginalArrivalTime: 05 May 2010 13:11:07.0843 (UTC) FILETIME=[6CB10930:01CAEC54]
Subject: Re: [TLS] RNG vs. PRNG
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 05 May 2010 13:10:22 -0000

-----Original Message-----
From: Dean Anderson

> If the RNG is truely random, it can not be biased either. The bias is
> the introduction of a non-random input; and by definition, a true RNG
> has no non-random inputs. So a 'biased RNG' is just the discovery that
> the device once thought to be an RNG was not one after all.

Sophistry.  A television that has been fried by lightning is still a TV,
albeit a broken one.  A 'biased RNG' may generate no entropy at all, in
which case it is broken.  Or it may generate entropy along with bias
that can be conditioned out.  If I take a true, fully functioning RNG
and add a constant value to every number it produces, the output becomes
biased.  But that bias is easily removed.  Adding zero or a small amount
of entropy to a sequence containing entropy does not remove *any*
entropy from that sequence.


> I suspect the NSA most likely used PRNG's in Clipper because PRNGs
were
> practical to implement whereas RNGs are not. Or perhaps it was a
mistake
> altogether; Recall that Clipper was broken.  
> http://findarticles.com/p/articles/mi_m0CGN/is_n140/ai_20909989/

Speaking from fact rather than uninformed speculation, RNGs are
practical to implement.  

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp004.pdf
says:

  12.
     c. Random Number Generator Test: Functional testing of ring
oscillators and
LFSR is performed.

Dave