SECURITY FRAMEWORKS FOR PSEUDORANDOM NUMBER GENERATORS

Abstract

In the cryptographic system a pseudorandom number generator is one of the basic primitives. We survey theoretically secure pseudorandom bit generators which are provably secure under certain reasonable number theoretic assumptions and some practical pseudorandom number generators based on assumptions about symmetric crypto-primitives. Recently, there was a noticeable result for the concrete security analysis of pseudorandom number generators used in practice. Thus we have a closer look on the Desai-Hevia-Yin's security framework and consider the provable security for some practical pseudorandom number generators.

Full text

Page 1

Trends in Mathematics
Information Center for Mathematical Sciences
Volume 8, Number 1, June, 2005, Pages 1–11
SECURITY FRAMEWORKS FOR PSEUDORANDOM NUMBER
GENERATORS
JU-SUNG KANG
Abstract. In the cryptographic system a pseudorandom number generator
is one of the basic primitives. We survey theoretically secure pseudorandom
bit generators which are provably secure under certain reasonable number
theoretic assumptions and some practical pseudorandom number generators
based on assumptions about symmetric crypto-primitives. Recently, there was
a noticeable result for the concrete security analysis of pseudorandom number
generators used in practice. Thus we have a closer look on the Desai-Hevia-
Yin’s security framework and consider the provable security for some practical
pseudorandom number generators.
1. Introduction
A pseudorandom number generator is one of the basic primitives for most cryp-
tographic systems. It is hard to imagine a cryptographic application that doesn’t
use random numbers. For example, seeds for key generation, session keys used for
encryption and authentication, salts to be hashed with passwords, the private key
in the DSA, the primes in the RSA, and nonces in protocols are all assumed to be
random. Because generating the real random sequence is expensive, most applica-
tions use a pseudorandom number generator (PRNG). The PRNG tries to stretch
a short string of random bits to a longer string that are indistinguishable from the
truly random string.
On the other hand, a random bit generator can be used to generate random
numbers. A random integer in the interval [0,n] can be obtained by generating
a random bit sequence of length ?logn? + 1, and converting it to an integer. If
the resulting integer exceeds n, we may discard it and generate a new random bit
sequence. A true random bit generator is a device or algorithm which outputs
a sequence of probabilistically independent and unbiased binary digits. While a
PRBG is defined by a deterministic algorithm which, given a truly random bit
sequence of length k, outputs a binary sequence of length l ? k which appears to
be random. The initial input to the PRBG is called the seed, and output of the
PRBG is called a pseudorandom bit sequence.
This work was supported by the new faculty research program 2004 of Kookmin University.
c ?2005 Information Center for Mathematical Sciences
1

Page 2

2JU-SUNG KANG
A rigorous theory of pseudorandom generators initiated by Blum and Micali [1],
and Yao [2] in the early 1980’s. Blum and Micali [1] presented a general construc-
tion for cryptographically secure PRBGs and proposed the first concrete instance of
cryptographically secure PRBG, called the Blum-Micali generator. Yao [2] showed
how to obtain a cryptographically secure PRBG using any one-way permutation.
H˚ astad et al. [3] generalized this result and showed how to construct a crypto-
graphically secure PRBG from any one-way function. Since it is easy to construct
a one-way function from a PRBG, the result of [3] disclosed the necessary and suf-
ficient condition for the existence of a PRBG. The one-way function is a function
easy to compute, but hard to invert. However we don’t know if theoretically perfect
one-way functions exist. A good block cipher and cryptographic hash functions are
regarded as strong candidates of the one-way function in real-world. It can also be
noted that if one relaxes the requirement that the PRBG be efficiently computable,
then cryptographically secure PRBGs do exist that pass all polynomial-time tests.
Kelsey et al. [4] discussed possible cryptanalytic attacks against their proposed
model for PRNGs. They considered PRNGs from an attacker’s perspective and
presented the strengths and weaknesses of four real-world PRNGs: the ANSI X9.17
PRNG, the DSA PRNG, the RSAREF PRNG, and CryptoLib. However Kelsey et
al.’s analysis was mostly ad hoc and based on heuristic arguments. Desai, Hevia,
and Yin [5] gave a general security framework for PRNGs, incorporating the attacks
that users were typically concerned about and analyzed the ANSI X9.17 PRNG and
the FIPS 186 PRNG. Their security framework did look at PRNGs from a provable-
security viewpoint which is similar to the security treatment of Bellare et al. [6, 22].
Desai-Hevia-Yin’s work provided a concrete security analysis for the PRNGs based
on efficient cryptographic primitives, such as block ciphers and hash functions.
In this paper, we briefly survey theoretically secure PRBGs that are provably
secure under certain reasonable number theoretic assumptions and some PRNG
constructions based on assumptions about symmetric crypto-primitives. Recently,
there was a noticeable result for the concrete security analysis of pseudorandom
number generators used in practice. Thus we have a closer look on the Desai-Hevia-
Yin’s security framework and consider the provable security for some practical
pseudorandom number generators.
2. Theoretically-secure PRBGs
A minimum security requirement for a PRBG is that the length k of the random
seed should be sufficiently large so that a search over 2kelements is infeasible
for the adversary. Two general requirements are that the output sequences of a
PRBG should be indistinguishable from truly random sequences, and the output
bits should be unpredictable to an adversary with limited computational resources.

Page 3

SECURITY FRAMEWORKS FOR PSEUDORANDOM NUMBER GENERATORS3
Definition 1. (Yao [2], Goldreich-Goldwasser-Micali [8]) A PRBG is said to pass
all polynomial-time statistical tests if no polynomial-time algorithm can correctly
distinguish between an output sequence of the generator and a truly random sequence
of the same length with probability significantly greater than 1/2.
Definition 2. (Yao [2], Goldreich-Goldwasser-Micali [8]) A PRBG is said to pass
the next-bit test if there is no polynomial-time algorithm which, on input of the first
l bits of an output sequence s, can predict the (l + 1)-st bit of s with probability
significantly greater than 1/2.
For the formal definitions of a polynomial-time statistical test and next-bit test,
see Yao [2] and Goldreich-Goldwasser-Micali [8]. Yao [2] showed that Definition 1
and 2 are equivalent and Goldreich, Goldwasser, and Micali [8] provided a general-
ization of Yao’s result.
Theorem 1. (Yao [2], Goldreich-Goldwasser-Micali [8]) A PRBG passes the next-
bit test if and only if it passes all polynomial-time statistical tests.
Blum-Micali [1] introduced the notion of a cryptographically strong PRBG as
the following definition.
Definition 3. A PRBG that passes the next-bit test is called a cryptographically
strong PRBG.
The pseudorandom sequence should have some statistical properties present in
truly random sequences. Many statistical properties of the linear congruential pseu-
dorandom number sequence
xi+1= a · xi+ b
(mod n)
have been studied by Knuth [9]. However, unlike truly random sequences, the next
number in a linear congruential sequence can be easily computed from the preceding
ones, even when x0, a, b, and n are not given [10]. While linear congruential
generators pass some statistical tests, they are predictable and thus entirely insecure
for cryptographic purposes. In this section we introduce three cryptographically
strong PRBGs.
Blum-Micali PRBG [1]
• Summary: a pseudorandom bit sequence y1,y2,...,ylof length l is gener-
ated.
(1) Let p be a large prime, and α a generator of Z∗
(2) Select a random seed x0∈ Z∗
(3) For 1 ≤ i ≤ l, do the following:
(a) xi← αxi−1(mod p)
p.
p.

Page 4

4JU-SUNG KANG
(b) If 0 ≤ xi−1= logαxi≤ (p−1)/2 then set yi← 1; otherwise set yi← 0.
(4) The output sequence is y1,y2,...,yl.
Assuming the intractability of the discrete logarithm problem in Z∗
Micali PRBG was proven to satisfy the next-bit test. Long-Wigderson [11] improved
the efficiency og the Blum-Micali PRBG by simultaneously extracting O(loglogp)
bits from each xi. Kaliski [12] modified the Blum-Micali PRBG so that the security
depends on the discrete logarithm problem in the group of points on an elliptic curve
defined over a finite field.
p, the Blum-
Blum-Blum-Shub PRBG [13]
• Summary: a pseudorandom bit sequence y1,y2,...,ylof length l is gener-
ated.
(1) Generate two large secret random and distinct primes p and q, each con-
gruent to 3 modulo 4, and compute n = pq.
(2) Select a random and secret seed s ∈ [1,n − 1] such that gcd(s,n) = 1, and
compute x0← s2(mod n).
(3) For 1 ≤ i ≤ l do the following:
(a) xi← x2
(b) yi← the least significant bit of xi.
(4) The output sequence is y1,y2,...,yl.
i−1(mod n).
Blum-Blum-Shub [13] showed that their PRBG is a cryptographically strong
assuming the intractability of the quadratic residuosity problem. Vazirani-Vazirani
[14] established a stronger result regarding the security of the Blum-Blum-Shub
PRBG by proving it cryptographically strong under the weaker assumption that
integer factorization is intractable.
RSA PRBG [15]
• Summary: a pseudorandom bit sequence y1,y2,...,ylof length l is gener-
ated.
(1) Generate two secret RSA-like primes p and q, and compute n = pq and
φ = (p − 1)(q − 1). Select a random integer e, 1 < e < φ, such that
gcd(e,φ) = 1.
(2) Select a random seed x0∈ [1,n − 1].
(3) For 1 ≤ i ≤ l do the following:
(a) xi← xe
(b) yi← the least significant bit of xi.
(4) The output sequence is y1,y2,...,yl.
i−1(mod n).

Page 5

SECURITY FRAMEWORKS FOR PSEUDORANDOM NUMBER GENERATORS5
Alexi et al. [15] proved that the RSA PRBG is a cryptogrphically strong under
the assumption that the RSA problem is intractable.
that the above RSA PRBG can be improved by extracting the j = cloglogn
least significant bits of xi, where c is a constant. Micalli-Schnorr [16] proposed a
modification improving the efficiency of the RSA PRBG. In their PRBG, one can
extact the k = ?N(1 − 2/e)? least significant bits of xi, where N = ?logn? + 1.
However Micali-Schnorr PRBG is cryptographically strong under the assumption
which stronger than requiring that the RSA problem be intractable.
Moreover they provided
3. Practical PRNGs
In section 2, we have introduced some constructions for pseudorandom number
generation that are provably secure under certain reasonable number theoretic as-
sumptions. However these theoretically secure PRBGs are still impractical. For
practical reasons, the PRNGs, that are in prevalent use today, are typically based
on efficient cryptographic primitives such as block ciphers and hash functions. In
this section we describe two most widely-used PRNGs, the ANSI X9.17 PRNG [17]
and the FIPS 186 PRNG [18].
ANSI X9.17 PRNG [17]
• Input: a random and secret 64-bit seed s, integer m, and Triple DES E-D-E
encryption key k.
• Output: m pseudorandom 64-bit strings x1, x2, ..., xm.
(1) Compute I = Ek(T), where T is a 64-bit representation of the date/time
to as fine a resolution as is available.
(2) For 1 ≤ i ≤ m do the following:
(a) xi← Ek(I ⊕ s).
(b) s ← Ek(xi⊕ I).
(3) Return (x1,x2,...,xm).
The ANSI X9.17 PRNG is a part of a popular banking standard for the purpose
of pseudorandomly generating keys and initialization vectors for the use with DES.
In the above algorithm, Ekdenotes DES E-D-E two-key triple-encryption under a
key k. Two-key triple-encryption is defined by E(x) = Ek1(Dk2(Ek1(x))), where
Dk= E−1
k.
FIPS 186 PRNG using SHA-1 for DSA private keys [18]
• Input: a 160-bit prime q and an integer m.
• Output: m pseudorandom integers a1, a2, ..., amin the interval [0,q − 1]
which may be used as DSA private keys.