Re: [TLS] RNG vs. PRNG

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> As an example, initialize an AES-256 block cipher with a perfectly
> random 256 bit key. Encrypt successive counter values starting with 0
> ("CTR mode") to obtain the random output in blocks. Any method by which
> one can predict or otherwise distinguish this output stream from "purely
> random bits" with less than 2**256 work represents a weakness in AES-256.
> 
> If you're using AES-256 for your TLS cipher, and the attacker knows a
> weakness in it, then you might have bigger problems than the quality of
> your RNG.

IANAC, but I would feel very uncomfortable with such a CPRNG.

If the CPRNG internal entropy pool has the same size as the
CPRNG output value, then consecutive output values will have
an extremely strong correlation, and because of that, it is
possible, at least in theory to determine the internal state
from looking at a "comparatively low" number of the output values.

If, on the other hand, your CPRNG internal entropy pool is at least
twice as large as the CPRNG output value, and you use a cryptographic
compression function, then it requires an unrealisticly huge amount of
consecutive output values before one is theoretically able to determine
the exact state of the internal entropy pool because of the
intentional collisions during computation of output values.

Btw. I assume it is much easier to gather "the equivalent of 256 bits"
of real entropy within a 512-bit "entropy pool" than to condense it
lossless into a 256-bit value.  And if one is a little conservative
in assessing the amount of entropy, then it probably makes sense
to use an entropy pool that can hold more than the equivalent of
256-bit of real entropy instead of using a container that is
guaranteed to unconditionally crush spare entropy.

-Martin