Cryptographically secure pseudorandom numbers
This article will continue our series on cryptography. Our articles to date have discussed random numbers and pseudorandom numbers. In this article, we will learn more about pseudorandom number generators that are suitable for cryptographic applications or cryptographically secure pseudorandom number generators. These generators use the CSPRNG acronym, where the CS prefix stands for cryptographically secure. To be considered cryptographically secure, a PRNG must pass all statistical tests for randomness, while a PRNG must only pass a subset of statistical tests. Statistical tests or randomness will tell us if the pattern of the numbers can be determined simply by looking at the sequence of numbers – so without knowing the seed value. Two of the most common CSPRNGs are: Yarrow and Fortuna (great name;).
Pseudorandom Number Generator (PRNG)
Examples are the random function for most programming languages like Java, Python, etc.
Cryptographically Secure Pseudorandom Number Generator (CSPRNG)
Examples are Yarrow and Fortuna.
Yarrow
The Yarrow algorithm was developed in 1999 and is unlicensed, so open to use by anyone. Yarrow was used in FreeBSD and in iOS for /dev/random but has now been replaced by Fortuna. Internally, Yarrow uses 2 other common algorithms: SHA-1 for generating hashes and three-key Triple-DES for encrypting data to generate its outputs. Yarrow was designed to use existing algorithms as its building blocks and to have a simple, easy to implement interface. Its simple interface helps system designers, who need to implement a PRNG, do so relatively quickly and easily with less risk of making mistakes during implementation.
Fortuna
Fortuna was released in 2003 and is the standard algorithm for FreeBSD and iOS /dev/random, which are special devices that serve as pseudorandom number generators.
PRNG by System
| System | PRNG Algorithm |
| iOS (iPhone, iPad, Mac) | Fortuna |
| FreeBSD, other Linux distributions | Fortuna |
| Windows 10 | Whitepaper written by co-creator of Fortuna Looks like Microsoft’s own algorithm though it seems similar to Fortuna conceptually |
| Android | SecureRandom |
Next up
Next we will discuss hashing.