Re: [TLS] RNG vs. PRNG

["Kemp, David P." <[e-mail]>]

-----Original Message-----
From: Dean Anderson

> If the RNG is truely random, it can not be biased either. The bias is
> the introduction of a non-random input; and by definition, a true RNG
> has no non-random inputs. So a 'biased RNG' is just the discovery that
> the device once thought to be an RNG was not one after all.

Sophistry.  A television that has been fried by lightning is still a TV,
albeit a broken one.  A 'biased RNG' may generate no entropy at all, in
which case it is broken.  Or it may generate entropy along with bias
that can be conditioned out.  If I take a true, fully functioning RNG
and add a constant value to every number it produces, the output becomes
biased.  But that bias is easily removed.  Adding zero or a small amount
of entropy to a sequence containing entropy does not remove *any*
entropy from that sequence.


> I suspect the NSA most likely used PRNG's in Clipper because PRNGs
were
> practical to implement whereas RNGs are not. Or perhaps it was a
mistake
> altogether; Recall that Clipper was broken.  
> http://findarticles.com/p/articles/mi_m0CGN/is_n140/ai_20909989/

Speaking from fact rather than uninformed speculation, RNGs are
practical to implement.  

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp004.pdf
says:

  12.
     c. Random Number Generator Test: Functional testing of ring
oscillators and
LFSR is performed.

Dave