Lecture 6 Dr.

Alshaimaa Abo-alian
[email protected]
Random Bit Generation
Lecture Outline

➢ Use of Random Numbers

➢ Requirements of Random Numbers
➢ Random Bit Generators
➢ Pseudorandom Number Generators
➢ Randomness Tests
➢ Linear Congruential Generator (LCG)
➢ Blum Blum Shub (BBS) Generator
➢ PRNG Mechanisms Based On Block Ciphers

2
Use of Random Numbers
Many cryptographic algorithms make use of random binary
numbers such as:
▪ Key distribution and authentication schemes
▪ Session key generation
▪ Generation of keys for the RSA public-key encryption
algorithm
▪ Generation of a bit stream for stream ciphers

3
Requirements of Random Numbers
There are two distinct requirements for a sequence of random
numbers:

Randomness Unpredictability

Hard to predict
The frequency of
Uniform next/previous value
occurrence of 1s &
distribution in sequence
0s are approximately
equal
No subsequence can
Independence be inferred from the
others
Random Bit Generators
• A random bit generator is a device or algorithm which outputs
a sequence of statistically independent and unbiased binary
digits.

• There are two main strategies for generating random

bits/numbers:
1. True Random Number Generators (TRNGs):
– Non-deterministic
– Using some physical source
2. Pseudorandom Number Generators (PRNGs)
– Deterministic.
– Using an algorithm.
5
 Random Number Generators
Hardware-
based
TRNG
Software-
Random based
Number
Generators Purpose-built • LCG
algorithms • BBS
PRNG
Existing Using block
Cryptographic ciphers
algorithms • OFB
• CTR
6
True Random Bit Generators
• A true random bit generator falls in one of two categories:
1. Hardware-based generators:
• Exploit the randomness which occurs in some physical
phenomena.
• Examples:
– Thermal noise from a semiconductor or resistor.
– Sound from a microphone or video input from a camera.

2. Software-based generators: Some processes such as:

• Elapsed time between keystrokes or mouse movement;
• Content of input/output buffers.
• Operating system values such as system load and network
statistics.
7
True Random Bit Generators

• Designing a TRNG that is free of biases and

correlations is a difficult and expensive task.

• So, it is more common to implement algorithms that

generate sequences of numbers that appear to be
random
➔ pseudorandom number generators (PRNGs)

8
Pseudorandom Number Generators
(PRNGs)
▪ Deterministic algorithms: given the same initial seed,
the generator will always produce the same output
sequence
▪ Therefore, produce sequences of numbers that are not
statistically random.
▪ However, if the algorithm is good, the resulting
sequences will pass many tests of randomness.

9
TRNG, PRNG, and PRF

10
TRNG, PRNG, and PRF
▪ True Random Number Generator (TRNG):
– Nondeterministic.
– may simply involve conversion of an analog source to a binary
output.
– may involve additional processing to overcome any bias in the
source
▪ Pseudorandom number generator (PRNG)
– An algorithm produces a continuous stream of bits
– Used for stream cipher applications

▪ Pseudorandom function (PRF)

– Used to produce a pseudorandom string of bits of some fixed
length
– Examples are symmetric encryption keys and nonces
11
PRNG Requirements
The basic requirement when a P R N G or P R F is used for a
cryptographic application is that it is hard to determine
pseudo-random stream if the adversary doesn’t know
seed (but knows algorithm)
▪ Randomness
– Generated bit stream appear random even though it is
deterministic
▪ Unpredictability
– Forward and backward unpredictability
▪ Seed characteristics
– Seed must be secure and unpredictable
12
PRNG Requirements
Randomness
• Any P R N G exhibits randomness on the basis of multiple
tests.

• N I S T S P 800-22 specifies that the tests should establish 3

characteristics:
– Uniformity: the occurrence of a 0 or 1 is equally likely
– Scalability: If a sequence is random, then any such
extracted subsequence should also be random.
– Consistency: The behavior of a generator must be
consistent across seeds.

13
PRNG Requirements
Randomness Tests
▪ NIST SP 800-22 lists 15 separate tests of randomness
➔ Scope of statistical analysis
▪ We will overview three of the tests and the purpose of
each test:
1. Frequency test
2. Runs test
3. Maurer’s universal statistical (compressability) test

14
Randomness Tests
1. Frequency Test
▪ The most basic test and must be included in any test
suite
▪ Also called monobit test
▪ Its purpose is to determine whether the number of 0’s
and 1’s in s are approximately the same, as would be
expected for a random sequence.
▪ In other words, it tests the closeness of the proportion
of 1s to 0.5.

15
Randomness Tests
2. Runs Test
▪ A run is an uninterrupted sequence of identical bits

▪ Focus of this test is the total number of runs in the

sequence

▪ Its purpose is to determine whether the number of

runs of 1s and 0s of various lengths is as expected for
a random sequence.

16
Randomness Tests
3. Maurer’s universal statistical test
▪ Focus is the number of bits between matching
patterns
▪ Purpose is to detect whether or not the sequence can
be significantly compressed without loss of
information.
▪ A compressible sequence is considered to be non-
random

17
 PRNG Requirements
Unpredictability
A stream of pseudorandom numbers should exhibit 2 forms of unpredictability:
1. Forward unpredictability
If the seed is unknown, the next output bit in the sequence should be
unpredictable in spite of any knowledge of previous bits in the sequence
2. Backward unpredictability
It should be infeasible to determine the seed from knowledge of any
generated values
➔ No correlation between a seed and any value generated

➢ The same set of tests for randomness also provides a test of unpredictability
➢ A random sequence will have no correlation with a fixed value (the seed)
18
PRNG Requirements
Seed Characteristics
▪ Because the PRNG is a deterministic algorithm, if the
adversary can deduce the seed, then the output can also be
determined.
➔Therefore, the seed must be unpredictable and secure.

▪ The seed itself must be a random or pseudorandom

number.
➔ Use TRNG to generate the seed

19
Linear Congruential Generator
(LCG)
Parameters:
m : the modulus, m > 0
a : the multiplier, 0 < a< m
c : the increment, 0≤ c < m
X0: the seed, 0 ≤ X0 < m
Output:
A sequence of random numbers {Xn} where Xn+1 = (aXn + c) mod m

➔ The selection of values for a , c , and m is critical in developing a

good random number generator
20
Linear Congruential Generator
(LCG)
Example:
consider the values a= 7, c=0, m= 32 and x0= 1.
This generates the sequence { 7, 17, 23, 1, 7, …}.
➔ The period of sequence is 4 which is clearly unsatisfactory.
Period is the max. number of outputs until the generator repeats
itself

If we change the value of a to 5, then the sequence is {5, 25, 29,

17, 21, 9, 13, 1, 5, ... }, which increases the period to 8.
➔ m should be large prime (e.g., 231)
21
Linear Congruential Generator
(LCG)
LCG is not cryptographically secure.
If the attacker knows any three subsequent output symbols of the
PRNG, he can get the values of a & c.
➔ The attacker can get the entire stream

22
Blum Blum Shub (BBS) Generator

Parameters:
p, q: large prime numbers such that p ≡ q ≡ 3 (mod 4)
n=p×q
s: random number relatively prime to n; gcd (s, n) = 1
Output: A sequence of bits, Bi, is generated according to the following :
X0 = s2 mod n
for i = 1 → ∞
Xi = (Xi−1) 2 mod n
Bi = Xi mod 2
Cryptographically secure pseudo-random bit generator (CSPRBG)

23
Blum Blum Shub (BBS) Generator
Example
n = 192649 = 383 × 503, s = 101355
i Xi Bi i Xi Bi
0 20749 Blank 11 137922 0
1 143135 1 12 123175 1
2 177671 1 13 8630 0
3 97048 0 14 114386 0
4 89992 0 15 14863 1
5 174051 1 16 133015 1
6 80649 1 17 106065 1
7 45663 1 18 45870 0
8 69442 0 19 137171 1
9 186894 0 20 48060 0
10 177046 0 24
Blum Blum Shub (BBS) Generator

 A CSPRBG is defined as one that passes the next-bit-test

 If given the first k bits of the sequence, there is no any
practical algorithm that can state if the next bit will be 1
(or 0) with probability greater than ½

 The security of BBS is based on the difficulty of factoring n

25
PRNG Mechanisms Based On
Block Ciphers
▪ Use symmetric block ciphers (e.g., AES, DES) to produce
pseudo-random bits
▪ Two approaches using:
1. CTR mode
2. OFB mode
▪ The seed consists of two parts (K & V):
1. K: The encryption key
2. V: The initial block value (which is updated after each
block of pseudorandom numbers is generated)

26
PRNG Mechanisms Based On
Block Ciphers

Vi = Vi-1 + 1 X0 = V
Xi = EK[Xi-1]
Xi = EK[Vi]
27
NIST CTR-DRBG

▪ NIST SP 800-90A defined PRNG based on the CTR mode

of operation
▪ Referred to as CTRDRBG (counter mode–deterministic
random bit generator).
▪ CTR-DRBG is widely implemented and is part of the
hardware random number generator implemented on
all recent Intel processor chips.
▪ The encryption algorithm used in the DRBG may be:
▪ 3DES with three keys
▪ AES with a key size of 128, 192, or 256 bits.

28
NIST CTR-DRBG Parameters
The CTR-DRBG algorithm has 4 parameters :
▪ Output block length (outlen): Length of the output
block of the encryption algorithm.
▪ Key length (keylen): Length of the encryption key.
▪ Seed length (seedlen): The seed will determine a
portion of the internal state of the DRBG, seedlen =
outlen + keylen.
▪ Reseed interval (reseed_interval): The maximum
number of output blocks generated before updating the
algorithm with a new seed.

29
 NIST CTR-DRBG Parameters

Blank 3DES AES-128 AES-192 AES-256

outlen 64 128 128 128
keylen 168 128 192 256
seedlen 232 256 320 384
reseed_interval ≤232 ≤248 ≤248 ≤248

30
NIST CTR-DRBG

31
Choose The Correct Answer
1. A __________ is used to produce a pseudorandom string of
bits of some fixed length.
A. PRF B. PRNG
C. OFB PRNG D. TRNG

2. A source that is effectively random is referred to as ________ .

A. an open source B. an entropy source
C. a keystream D. a seed

32
Choose The Correct Answer
3. Two approaches that use a block cipher to build a PRNG and
have gained widespread acceptance are:
A. CTR and CFB modes B. CTR and OFB modes
C. CBC and CFB modes D. OFB and ECB modes

4. A __________ uses a nondeterministic source to produce

randomness.
A. CSPRBG B. BBS
C. PRNG D. TRNG

33
Thank you

34