2 Random number generators

In this chapter, we lay the foundations for understanding what random numbers are and some different kinds of random number generators (RNGs). We’ll implement and exploit an insecure but widely used type of RNG known as a linear-congruential generator (LCGs). LCGs are not meant to be used for security-sensitive applications but will help us get into the habit of implementing and exploiting algorithms. (In the next chapter, we’ll implement and exploit a cryptographically secure RNG.)

My first encounter with randomness was when I used the RAND button on my father’s scientific calculator. Whenever I pressed it, I got a seemingly different number. This confused me endlessly. As a kid, you have some intuition about the limits of the world around you. For example, although folks on TV represent real people, you cannot physically go inside the box. I understood that human beings had created machines that could calculate 2 + 2 and give us answers. But the machine was under our control.

2.1 Why do we need random numbers for cryptography?

2.1.1 Uniform distribution: Making things harder to guess

2.1.2 Entropy: Quantifying unpredictability

2.2 Understanding different types of RNGs

2.2.1 True random number generators (TRNGs)

2.2.2 Pseudo random number generators (PRNGs)

2.2.3 Cryptographically secure pseudorandom number generators (CSPRNGs)

Summary