Hacker News Reader

Comment by jrexilius | Hacker News Reader

Forgive my ignorance on this but does his assertion that a CSPRNG is all you need after an initial truly random seed, hold up against theoretical quantum attacks? If not, then I could see the need for very large/fast sources of entropy for OTP uses and such?

View on HN

> Forgive my ignorance on this but does his assertion that a CSPRNG is all you need after an initial truly random seed, hold up against theoretical quantum attacks?

Yes, if you mean by "theoretical quantum attacks" the stuff we could run if we had a scalable quantum computer. Those impact public key crypto. They do nothing to impact the security of RNGs.

It's true that the stream-cipher and/or hash-based CSPRNG constructions that are commonly used are not broken by quantum computing.

CRQCs impact more than just public key crypto though, and there's more than one way to design a CSPRNG, so it's not true in the general case that they have "no" impact on RNGs.

I believe that Blum Blum Shub, Blum–Micali and Dual_EC_DRBG (backdoor aside) would also be broken by a CRQC.

Technically correct, but the RNGs you're mentioning are essentially RNGs build on public key cryptography. And I don't think they're widely used, simply because they're slow and have no advantage over faster ones (the Dual EC stuff was, as far as I know, the only thing that was somewhat widely used, and, very obviously, nobody should be using that).

Grover’s algorithm gives a square root speedup on many symmetric algorithms. This isn’t a disaster: it means you have to simply double your key (or hash digest or seed) sizes. But not every symmetric PRG out there is careful about this: some older ones may use 128 bit keys.

Reply on news.ycombinator.com