Hacker News Reader

Comment by glitchc | Hacker News Reader

An alternative to the post is to take any PRNG's output and calculate the SHA3 hash of it, then use the hash as the random number. If SHA3 is not available, use AES. In either case, all statistical weaknesses and side-channel attacks will be eliminated.

The platform is far more likely to have support for either of those in the system libraries, than a bespoke CSPRNG, which would need to be packaged with your app/game.

View on HN

Would be better to simply use a counter and a random seed in that case. Who knows when your prng will loop around, but your counter will always loop at 2^32.

At which point, if you use AES, you've just implemented the AES-CTR csprng that TFA suggests.

The sponge design of SHA-3 makes it a CSPRNG basically. You can keep draining it after you fed the data in.

That's a great poin, even better.

You can do something similar with any cryptographic hash; just feed a (say) 128 bit counter through the hash function, and collect the outputs.

That might be convenient so you don’t have to go fishing for 3rd party libraries - which is especially a problem in C/C++. But I expect the result will be much slower than using an optimized csrng like chacha.

Well, ChaCha is actually a hash function. Specifically it was a candidate for SHA3 but was beaten by Keccak in the final spec. Additionally, aes-ctr-128 has the same performance as ChaCha (1.5 GB/s).

All I was trying to illustrate was that in general, pairing a PRNG with a block cipher or hash function is sufficient to create a CSPRNG, and any developers worried about their PRNGs can couple rand() with a readily available cipher/hash in the system libraries. After all the blog is explicit about not requiring a cryptographically secure RNG for most applications.

As alright2565 already mentioned, sticking rand() in there doesn't add any benefit over a key + counter.

Without rand() it would be something like SHA3-CTR -- it's not standardized which is why I would prefer ChaCha20, but it has been proposed for standardization and yes it's probably a fine algorithm.

> it's probably a fine algorithm.

Yeah. I'm nervous about inventing my own RNG. It seems like one of those things thats much more difficult than it appears on the surface. Especially an RNG thats aiming to be crypto-secure.

> I'm nervous about inventing my own RNG.

You should be, but in this case you’re actually not inventing your own CSPRNG.

NIST SP 800-90A defines HASH_DRBG as hashing a seed (aka key) plus a counter and it is defined for basically any cryptographic hash function.

ChaChah is a stream cipher and was never a SHA3 candidate.

Reply on news.ycombinator.com