A cryptographically secure pseudorandom number generator (CSPRNG) is a deterministic, seed-driven generator designed for cryptographic use. Like other PRNGs, it expands a seed into a fast stream of values; unlike weak PRNGs, it adds security requirements that make its state and outputs hard for an attacker to reverse or predict. Its output should also have high entropy, supported by a uniform distribution. section 2.2 section 2.3
Model a CSPRNG as three functions: Init(Seed) creates an initial state, Next(StateN) advances it to StateN+1, and Output(StateN) produces OutputN. Security depends on carefully choosing Next and Output so that observing output does not feasibly reveal the internal state, prior values, or future values. A generator can look statistically random yet fail this requirement if its state transition or output transformation is reversible. section 2.2.3 section 3.3
Figure 2.12 PRNG as a state-machine
The state-machine diagram separates seeding, state advancement, and output generation—the boundaries at which a secure design must resist reversal. section 2.2.3
Use a CSPRNG as part of an entropy pipeline, not as an isolated source of security:
- Seed it with unpredictable entropy from a TRNG or hardware RNG. A guessed seed lets an attacker reproduce the entire deterministic sequence. section 2.2 section 2.2.3
- Continuously health-test raw physical entropy before conditioning it, and stop random-number generation when those tests fail. section 10.2
- Reseed periodically from the entropy source so one seed is not used indefinitely and state-extension risk is reduced. section 2.3 section 10.2
- Avoid default or weak noncryptographic PRNGs for cryptographic operations, even when their values appear random. section 2.3
Keystream for a stream cipher
A CSPRNG can turn a fixed-length seed into as many pseudorandom bytes as encryption needs. For a 1 GB video, both parties can share the seed and independently generate a 1 GB keystream, rather than exchange a 1 GB one-time-pad key. Even if known plaintext exposes keystream bytes, the generator should prevent recovery of the original seed. section 4.1.2
Concrete failures show why cryptographic security is more than fast generation. MT19937 has 624 state values, and 624 observed outputs can reveal its entire state and predict subsequent values. DUAL_EC_DRBG illustrates a different risk: constants can be backdoored so an observer predicts future output from only a few values. Current NIST SP 800-90A guidance instead recommends CTR DRBG, hash DRBG, or HMAC DRBG constructions. section 3.3 section 10.1.1
Figure 10.2 The recommended setup for using randomness for cryptographic applications: health tests should ensure the correct operation of the TRNG, which should periodically reseed a CSPRNG.
The diagram ties together health-tested physical entropy, conditioning, and periodic reseeding of a fast CSPRNG. section 10.2
