Mersenne Twister is a deterministic pseudorandom number generator family built from recurrences associated with Mersenne primes. Its defining appeal is an extremely long period, but long repetition time does not make it cryptographically secure. section 3.1 section 3.1.1
MT19937 is the commonly examined instance, using the prime 2^19937−1 and an internal state of 624 32-bit values. Seeding fills that state, generation applies a twist transformation, and tempering transforms each state value into output. section 3.1.1
The implementation exposes the weakness through a short sequence of operations:
- Seed the first state value and derive the remaining 623 values with the initialization recurrence. section 3.1.1
- Twist the state after every 624 outputs by combining neighboring values and applying shifts, masks, and XOR. section 3.1.1
- Temper each selected state value with XOR, shifts, and masks before returning it. section 3.1.1
Cloning MT19937 from output
An attacker observes 624 generated values, reverses the tempering operation on each with untemper, and reconstructs the complete internal state. A cloned generator then predicts subsequent outputs; the accompanying test compares 100 future values and passes. section 3.1.2 section 3.3
Listing 3.9 exploit_mt19937.go
func CloneMT19937(mt *impl_mt19937.MT19937) *impl_mt19937.MT19937 {
var recoveredState [impl_mt19937.N]uint32
for i := uint32(0); i < impl_mt19937.N; i++ {
recoveredState[i] = untemper(mt.Generate())
}
return impl_mt19937.NewMT19937WithState(recoveredState)
}
Inspect the compact cloning function that collects 624 outputs, untempers them, and constructs a generator from the recovered state. section 3.1.2
Use MT19937 for general-purpose randomness only, never for cryptographic applications. Security-oriented generators must make state recovery from outputs difficult; otherwise observed values can expose all future values. section 3.1.1 section 3.3
