Mixing
What is the difference between TRNG and CSRNG?
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
I understand the output of a $TRNG$ is almost impossible to reproduce, such a flipping a coin $100$ times to produce a $100$-bit sequence. However, it is also my understanding that a $CSPRNG$ produces an unpredictable output.
- If they are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
- Do we not use both $TRNG$ and $CSPRNG$ to produce sessions keys?
- Can we (do we?) use $TRNG$ to produce $CSPRNG$?
random-number-generator randomness pseudo-random-permutation
asked 4 hours ago
Red Book 1
448414
add a comment |Â
up vote
1
down vote
favorite
I understand the output of a $TRNG$ is almost impossible to reproduce, such a flipping a coin $100$ times to produce a $100$-bit sequence. However, it is also my understanding that a $CSPRNG$ produces an unpredictable output.
- If they are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
- Do we not use both $TRNG$ and $CSPRNG$ to produce sessions keys?
- Can we (do we?) use $TRNG$ to produce $CSPRNG$?
random-number-generator randomness pseudo-random-permutation
asked 4 hours ago
Red Book 1
448414
2
This When is an RNG a CSPRNG, a CSRNG, or a TRNG? may help.
– kelalaka
2 hours ago
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I understand the output of a $TRNG$ is almost impossible to reproduce, such a flipping a coin $100$ times to produce a $100$-bit sequence. However, it is also my understanding that a $CSPRNG$ produces an unpredictable output.
- If they are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
- Do we not use both $TRNG$ and $CSPRNG$ to produce sessions keys?
- Can we (do we?) use $TRNG$ to produce $CSPRNG$?
random-number-generator randomness pseudo-random-permutation
asked 4 hours ago
Red Book 1
448414
I understand the output of a $TRNG$ is almost impossible to reproduce, such a flipping a coin $100$ times to produce a $100$-bit sequence. However, it is also my understanding that a $CSPRNG$ produces an unpredictable output.
- If they are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
- Do we not use both $TRNG$ and $CSPRNG$ to produce sessions keys?
- Can we (do we?) use $TRNG$ to produce $CSPRNG$?
random-number-generator randomness pseudo-random-permutation
random-number-generator randomness pseudo-random-permutation
asked 4 hours ago
Red Book 1
448414
asked 4 hours ago
Red Book 1
448414
asked 4 hours ago
Red Book 1
448414
asked 4 hours ago
Red Book 1
448414
asked 4 hours ago
Red Book 1
448414
448414
2
This When is an RNG a CSPRNG, a CSRNG, or a TRNG? may help.
– kelalaka
2 hours ago
add a comment |Â
2
This When is an RNG a CSPRNG, a CSRNG, or a TRNG? may help.
– kelalaka
2 hours ago
2
2
This When is an RNG a CSPRNG, a CSRNG, or a TRNG? may help.
– kelalaka
2 hours ago
This When is an RNG a CSPRNG, a CSRNG, or a TRNG? may help.
– kelalaka
2 hours ago
add a comment |Â
2 Answers
2
active
oldest
votes
up vote
3
down vote
accepted
A True Random Number Gnerator uses a physical phenomenon as an origin of the randomness of what it outputs.
That phenomenon can be a dice throw, thermal noise, disintegration of a radioactive substance…
What detects this phenomenon can be followed by a conditioning stage to turn the output into an (at least, near) ideal sequence of random bits.
The archetypal conditioning stage is the Von Neumann's debiaser: it groups the values at the input (such as dice values, binary output of a comparator, count of clock cycles between events…) into pairs, and outputs 0, nothing, or 1, depending on if the first element in the pair is less, equal or more than the second. If the input consists of independent values, the output (if any) is independent random values with 50% probability for 0 and for 1; that is, truly random bits.
A Cryptographically Secure Random Number Generator (not Pseudo) is a random generator which output is computationally indistinguishable from truly random bits, with cryptographic certainty.
A TRNG can be a CSRNG. Any CSRNG must include a TRNG or must have made use of one as source of secret values at some initialization stage (otherwise, knowledge of the CSRNG would allow to predict its output).
A (Cryptographically Secure) Pseudo Random Number Generator is a deterministic (hence the Pseudo) computational method to turn a (typically short or low-throughput) secret input into a (typically arbitrarily long or/and high-throughput) sequence of bits that are computationally indistinguishable from truly random bits for one not knowing the input.
The archetypal CSRNG is built from CSPRNG, and a TRNG which output is used as input of the CSPRNG. The idea is that the cryptographic strength of the CSRNG comes mainly from the (CS)PRNG, and the unpredictability comes from the TRNG.
It is notoriously difficult to make a good CSRNG even by applying the above principle and using a good CSPRNG. In practice, TRNGs often fail, spontaneously or under adversarial influence (for example, an adversary can reduce thermal noise by putting the device in cold condition using evaporation of some liquefied gas, or remotely feed controlled events to a sensor of disintegration). If that goes undetected, the output of the TRNG can become highly predictable, and knowledge of the PRNG will allow to predict its output. Thus a practical CSRNG must test its TRNG, and somewhat prevent any output when it does not operate properly.
The question uses CSRNG in the title, and CSPRNG in the body, sometime where CSRNG is thought.
CSPRNGs are deterministic. TRNGs are not deterministic. CSRNGs at least appear not deterministic, and are indistinguishable from true random (as are CSPRNG for random secret inpout), but can be deterministic or not (in the former case, they include a random secret key).
If they (TRNG and CSRNG) are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
A TRNG must derive randomness from a physical source while it operates. A CSRNG needs not: it can be purely deterministic after initialization (e.g. a block cipher with a secret key enciphering a counter, with the secret key and counter in EEPROM memory protected from reading).
Also, a TRNG could have its outputs perceptibly biased or/and correlated, a CSPRNG must not.
Do we not use both TRNG and CSPRNG to produce sessions keys?
Most often we use a CSPRNG initialized with a shared secret and some other element (like a nonce) to initialize session keys, so that the session keys needs not be transmitted secretly.
If we use the output of a CSRNG or TRNG as a session key, we need to encipher the value produced on one side to transfer it to the other side, which has no way to produce the same session key independently. Further, it we use a TRNG directly, we must use one that is close enough to a CSRNG that the key can't be guessed (that's an issue for short keys).
Another practice is to use a CSRNG or TRNG as input to asymmetric crypto (like Diffie-Hellman) to produce a shared session key.
Can we (do we?) use TRNG to produce CSPRNG?
No. But we often use a TRNG and a CSPRNG to produce a CSRNG.
answered 3 hours ago
fgrieu
74.9k7153316
add a comment |Â
up vote
0
down vote
A TRNG is a physical device that produces a non deterministic output, whilst a CSPRNG is a mathematical device that always produces an identical output given the same starting point (deterministic).
You have to be able to hold a TRNG in your hand.
answered 1 hour ago
Paul Uszak
6,59011433
add a comment |Â
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
3
down vote
accepted
A True Random Number Gnerator uses a physical phenomenon as an origin of the randomness of what it outputs.
That phenomenon can be a dice throw, thermal noise, disintegration of a radioactive substance…
What detects this phenomenon can be followed by a conditioning stage to turn the output into an (at least, near) ideal sequence of random bits.
The archetypal conditioning stage is the Von Neumann's debiaser: it groups the values at the input (such as dice values, binary output of a comparator, count of clock cycles between events…) into pairs, and outputs 0, nothing, or 1, depending on if the first element in the pair is less, equal or more than the second. If the input consists of independent values, the output (if any) is independent random values with 50% probability for 0 and for 1; that is, truly random bits.
A Cryptographically Secure Random Number Generator (not Pseudo) is a random generator which output is computationally indistinguishable from truly random bits, with cryptographic certainty.
A TRNG can be a CSRNG. Any CSRNG must include a TRNG or must have made use of one as source of secret values at some initialization stage (otherwise, knowledge of the CSRNG would allow to predict its output).
A (Cryptographically Secure) Pseudo Random Number Generator is a deterministic (hence the Pseudo) computational method to turn a (typically short or low-throughput) secret input into a (typically arbitrarily long or/and high-throughput) sequence of bits that are computationally indistinguishable from truly random bits for one not knowing the input.
The archetypal CSRNG is built from CSPRNG, and a TRNG which output is used as input of the CSPRNG. The idea is that the cryptographic strength of the CSRNG comes mainly from the (CS)PRNG, and the unpredictability comes from the TRNG.
It is notoriously difficult to make a good CSRNG even by applying the above principle and using a good CSPRNG. In practice, TRNGs often fail, spontaneously or under adversarial influence (for example, an adversary can reduce thermal noise by putting the device in cold condition using evaporation of some liquefied gas, or remotely feed controlled events to a sensor of disintegration). If that goes undetected, the output of the TRNG can become highly predictable, and knowledge of the PRNG will allow to predict its output. Thus a practical CSRNG must test its TRNG, and somewhat prevent any output when it does not operate properly.
The question uses CSRNG in the title, and CSPRNG in the body, sometime where CSRNG is thought.
CSPRNGs are deterministic. TRNGs are not deterministic. CSRNGs at least appear not deterministic, and are indistinguishable from true random (as are CSPRNG for random secret inpout), but can be deterministic or not (in the former case, they include a random secret key).
If they (TRNG and CSRNG) are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
A TRNG must derive randomness from a physical source while it operates. A CSRNG needs not: it can be purely deterministic after initialization (e.g. a block cipher with a secret key enciphering a counter, with the secret key and counter in EEPROM memory protected from reading).
Also, a TRNG could have its outputs perceptibly biased or/and correlated, a CSPRNG must not.
Do we not use both TRNG and CSPRNG to produce sessions keys?
Most often we use a CSPRNG initialized with a shared secret and some other element (like a nonce) to initialize session keys, so that the session keys needs not be transmitted secretly.
If we use the output of a CSRNG or TRNG as a session key, we need to encipher the value produced on one side to transfer it to the other side, which has no way to produce the same session key independently. Further, it we use a TRNG directly, we must use one that is close enough to a CSRNG that the key can't be guessed (that's an issue for short keys).
Another practice is to use a CSRNG or TRNG as input to asymmetric crypto (like Diffie-Hellman) to produce a shared session key.
Can we (do we?) use TRNG to produce CSPRNG?
No. But we often use a TRNG and a CSPRNG to produce a CSRNG.
answered 3 hours ago
fgrieu
74.9k7153316
add a comment |Â
up vote
3
down vote
accepted
A True Random Number Gnerator uses a physical phenomenon as an origin of the randomness of what it outputs.
That phenomenon can be a dice throw, thermal noise, disintegration of a radioactive substance…
What detects this phenomenon can be followed by a conditioning stage to turn the output into an (at least, near) ideal sequence of random bits.
The archetypal conditioning stage is the Von Neumann's debiaser: it groups the values at the input (such as dice values, binary output of a comparator, count of clock cycles between events…) into pairs, and outputs 0, nothing, or 1, depending on if the first element in the pair is less, equal or more than the second. If the input consists of independent values, the output (if any) is independent random values with 50% probability for 0 and for 1; that is, truly random bits.
A Cryptographically Secure Random Number Generator (not Pseudo) is a random generator which output is computationally indistinguishable from truly random bits, with cryptographic certainty.
A TRNG can be a CSRNG. Any CSRNG must include a TRNG or must have made use of one as source of secret values at some initialization stage (otherwise, knowledge of the CSRNG would allow to predict its output).
A (Cryptographically Secure) Pseudo Random Number Generator is a deterministic (hence the Pseudo) computational method to turn a (typically short or low-throughput) secret input into a (typically arbitrarily long or/and high-throughput) sequence of bits that are computationally indistinguishable from truly random bits for one not knowing the input.
The archetypal CSRNG is built from CSPRNG, and a TRNG which output is used as input of the CSPRNG. The idea is that the cryptographic strength of the CSRNG comes mainly from the (CS)PRNG, and the unpredictability comes from the TRNG.
It is notoriously difficult to make a good CSRNG even by applying the above principle and using a good CSPRNG. In practice, TRNGs often fail, spontaneously or under adversarial influence (for example, an adversary can reduce thermal noise by putting the device in cold condition using evaporation of some liquefied gas, or remotely feed controlled events to a sensor of disintegration). If that goes undetected, the output of the TRNG can become highly predictable, and knowledge of the PRNG will allow to predict its output. Thus a practical CSRNG must test its TRNG, and somewhat prevent any output when it does not operate properly.
The question uses CSRNG in the title, and CSPRNG in the body, sometime where CSRNG is thought.
CSPRNGs are deterministic. TRNGs are not deterministic. CSRNGs at least appear not deterministic, and are indistinguishable from true random (as are CSPRNG for random secret inpout), but can be deterministic or not (in the former case, they include a random secret key).
If they (TRNG and CSRNG) are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
A TRNG must derive randomness from a physical source while it operates. A CSRNG needs not: it can be purely deterministic after initialization (e.g. a block cipher with a secret key enciphering a counter, with the secret key and counter in EEPROM memory protected from reading).
Also, a TRNG could have its outputs perceptibly biased or/and correlated, a CSPRNG must not.
Do we not use both TRNG and CSPRNG to produce sessions keys?
Most often we use a CSPRNG initialized with a shared secret and some other element (like a nonce) to initialize session keys, so that the session keys needs not be transmitted secretly.
If we use the output of a CSRNG or TRNG as a session key, we need to encipher the value produced on one side to transfer it to the other side, which has no way to produce the same session key independently. Further, it we use a TRNG directly, we must use one that is close enough to a CSRNG that the key can't be guessed (that's an issue for short keys).
Another practice is to use a CSRNG or TRNG as input to asymmetric crypto (like Diffie-Hellman) to produce a shared session key.
Can we (do we?) use TRNG to produce CSPRNG?
No. But we often use a TRNG and a CSPRNG to produce a CSRNG.
answered 3 hours ago
fgrieu
74.9k7153316
add a comment |Â
up vote
3
down vote
accepted
up vote
3
down vote
accepted
A True Random Number Gnerator uses a physical phenomenon as an origin of the randomness of what it outputs.
That phenomenon can be a dice throw, thermal noise, disintegration of a radioactive substance…
What detects this phenomenon can be followed by a conditioning stage to turn the output into an (at least, near) ideal sequence of random bits.
The archetypal conditioning stage is the Von Neumann's debiaser: it groups the values at the input (such as dice values, binary output of a comparator, count of clock cycles between events…) into pairs, and outputs 0, nothing, or 1, depending on if the first element in the pair is less, equal or more than the second. If the input consists of independent values, the output (if any) is independent random values with 50% probability for 0 and for 1; that is, truly random bits.
A Cryptographically Secure Random Number Generator (not Pseudo) is a random generator which output is computationally indistinguishable from truly random bits, with cryptographic certainty.
A TRNG can be a CSRNG. Any CSRNG must include a TRNG or must have made use of one as source of secret values at some initialization stage (otherwise, knowledge of the CSRNG would allow to predict its output).
A (Cryptographically Secure) Pseudo Random Number Generator is a deterministic (hence the Pseudo) computational method to turn a (typically short or low-throughput) secret input into a (typically arbitrarily long or/and high-throughput) sequence of bits that are computationally indistinguishable from truly random bits for one not knowing the input.
The archetypal CSRNG is built from CSPRNG, and a TRNG which output is used as input of the CSPRNG. The idea is that the cryptographic strength of the CSRNG comes mainly from the (CS)PRNG, and the unpredictability comes from the TRNG.
It is notoriously difficult to make a good CSRNG even by applying the above principle and using a good CSPRNG. In practice, TRNGs often fail, spontaneously or under adversarial influence (for example, an adversary can reduce thermal noise by putting the device in cold condition using evaporation of some liquefied gas, or remotely feed controlled events to a sensor of disintegration). If that goes undetected, the output of the TRNG can become highly predictable, and knowledge of the PRNG will allow to predict its output. Thus a practical CSRNG must test its TRNG, and somewhat prevent any output when it does not operate properly.
The question uses CSRNG in the title, and CSPRNG in the body, sometime where CSRNG is thought.
CSPRNGs are deterministic. TRNGs are not deterministic. CSRNGs at least appear not deterministic, and are indistinguishable from true random (as are CSPRNG for random secret inpout), but can be deterministic or not (in the former case, they include a random secret key).
If they (TRNG and CSRNG) are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
A TRNG must derive randomness from a physical source while it operates. A CSRNG needs not: it can be purely deterministic after initialization (e.g. a block cipher with a secret key enciphering a counter, with the secret key and counter in EEPROM memory protected from reading).
Also, a TRNG could have its outputs perceptibly biased or/and correlated, a CSPRNG must not.
Do we not use both TRNG and CSPRNG to produce sessions keys?
Most often we use a CSPRNG initialized with a shared secret and some other element (like a nonce) to initialize session keys, so that the session keys needs not be transmitted secretly.
If we use the output of a CSRNG or TRNG as a session key, we need to encipher the value produced on one side to transfer it to the other side, which has no way to produce the same session key independently. Further, it we use a TRNG directly, we must use one that is close enough to a CSRNG that the key can't be guessed (that's an issue for short keys).
Another practice is to use a CSRNG or TRNG as input to asymmetric crypto (like Diffie-Hellman) to produce a shared session key.
Can we (do we?) use TRNG to produce CSPRNG?
No. But we often use a TRNG and a CSPRNG to produce a CSRNG.
answered 3 hours ago
fgrieu
74.9k7153316
A True Random Number Gnerator uses a physical phenomenon as an origin of the randomness of what it outputs.
That phenomenon can be a dice throw, thermal noise, disintegration of a radioactive substance…
What detects this phenomenon can be followed by a conditioning stage to turn the output into an (at least, near) ideal sequence of random bits.
The archetypal conditioning stage is the Von Neumann's debiaser: it groups the values at the input (such as dice values, binary output of a comparator, count of clock cycles between events…) into pairs, and outputs 0, nothing, or 1, depending on if the first element in the pair is less, equal or more than the second. If the input consists of independent values, the output (if any) is independent random values with 50% probability for 0 and for 1; that is, truly random bits.
A Cryptographically Secure Random Number Generator (not Pseudo) is a random generator which output is computationally indistinguishable from truly random bits, with cryptographic certainty.
A TRNG can be a CSRNG. Any CSRNG must include a TRNG or must have made use of one as source of secret values at some initialization stage (otherwise, knowledge of the CSRNG would allow to predict its output).
A (Cryptographically Secure) Pseudo Random Number Generator is a deterministic (hence the Pseudo) computational method to turn a (typically short or low-throughput) secret input into a (typically arbitrarily long or/and high-throughput) sequence of bits that are computationally indistinguishable from truly random bits for one not knowing the input.
The archetypal CSRNG is built from CSPRNG, and a TRNG which output is used as input of the CSPRNG. The idea is that the cryptographic strength of the CSRNG comes mainly from the (CS)PRNG, and the unpredictability comes from the TRNG.
It is notoriously difficult to make a good CSRNG even by applying the above principle and using a good CSPRNG. In practice, TRNGs often fail, spontaneously or under adversarial influence (for example, an adversary can reduce thermal noise by putting the device in cold condition using evaporation of some liquefied gas, or remotely feed controlled events to a sensor of disintegration). If that goes undetected, the output of the TRNG can become highly predictable, and knowledge of the PRNG will allow to predict its output. Thus a practical CSRNG must test its TRNG, and somewhat prevent any output when it does not operate properly.
The question uses CSRNG in the title, and CSPRNG in the body, sometime where CSRNG is thought.
CSPRNGs are deterministic. TRNGs are not deterministic. CSRNGs at least appear not deterministic, and are indistinguishable from true random (as are CSPRNG for random secret inpout), but can be deterministic or not (in the former case, they include a random secret key).
If they (TRNG and CSRNG) are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
A TRNG must derive randomness from a physical source while it operates. A CSRNG needs not: it can be purely deterministic after initialization (e.g. a block cipher with a secret key enciphering a counter, with the secret key and counter in EEPROM memory protected from reading).
Also, a TRNG could have its outputs perceptibly biased or/and correlated, a CSPRNG must not.
Do we not use both TRNG and CSPRNG to produce sessions keys?
Most often we use a CSPRNG initialized with a shared secret and some other element (like a nonce) to initialize session keys, so that the session keys needs not be transmitted secretly.
If we use the output of a CSRNG or TRNG as a session key, we need to encipher the value produced on one side to transfer it to the other side, which has no way to produce the same session key independently. Further, it we use a TRNG directly, we must use one that is close enough to a CSRNG that the key can't be guessed (that's an issue for short keys).
Another practice is to use a CSRNG or TRNG as input to asymmetric crypto (like Diffie-Hellman) to produce a shared session key.
Can we (do we?) use TRNG to produce CSPRNG?
No. But we often use a TRNG and a CSPRNG to produce a CSRNG.
answered 3 hours ago
fgrieu
74.9k7153316
edited 1 hour ago
answered 3 hours ago
fgrieu
74.9k7153316
answered 3 hours ago
fgrieu
74.9k7153316
answered 3 hours ago
fgrieu
74.9k7153316
74.9k7153316
add a comment |Â
add a comment |Â
up vote
0
down vote
A TRNG is a physical device that produces a non deterministic output, whilst a CSPRNG is a mathematical device that always produces an identical output given the same starting point (deterministic).
You have to be able to hold a TRNG in your hand.
answered 1 hour ago
Paul Uszak
6,59011433
add a comment |Â
up vote
0
down vote
A TRNG is a physical device that produces a non deterministic output, whilst a CSPRNG is a mathematical device that always produces an identical output given the same starting point (deterministic).
You have to be able to hold a TRNG in your hand.
answered 1 hour ago
Paul Uszak
6,59011433
add a comment |Â
up vote
0
down vote
up vote
0
down vote
A TRNG is a physical device that produces a non deterministic output, whilst a CSPRNG is a mathematical device that always produces an identical output given the same starting point (deterministic).
You have to be able to hold a TRNG in your hand.
answered 1 hour ago
Paul Uszak
6,59011433
A TRNG is a physical device that produces a non deterministic output, whilst a CSPRNG is a mathematical device that always produces an identical output given the same starting point (deterministic).
You have to be able to hold a TRNG in your hand.
answered 1 hour ago
Paul Uszak
6,59011433
answered 1 hour ago
Paul Uszak
6,59011433
answered 1 hour ago
Paul Uszak
6,59011433
answered 1 hour ago
Paul Uszak
6,59011433
6,59011433
add a comment |Â
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63555%2fwhat-is-the-difference-between-trng-and-csrng%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
2
This When is an RNG a CSPRNG, a CSRNG, or a TRNG? may help.
– kelalaka
2 hours ago