True random number generators use an unpredictable physical means to generate numbers, whereas pseudo-random numbers utilize mathematical formulas to produce a certain sequence of numbers that will appear random. I know that for PRNGs the efficiency is very high because they tend to generate a large quantity of random numbers in a short amount of time. Beside reproducibility and efficiency, what are the advantages of using PRNG over TRNG?
1
-
1$\begingroup$ PRNs can be produced programmatically. TRNs require a "physical" entropy source, which can be a "device" or event timing information; the former requires the presence of a specific type of device, the latter breaks the timing-independent abstraction commonly used for programming. However, the main advantages seem to be reproducibility and data rate. $\endgroup$– user4577Commented Mar 27, 2021 at 20:42
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
5
It's an apples and oranges comparison.
When you want something to be truly random, you must use a TRNG. Examples include a lottery, or a secret/private key in cryptography.
When you want something repeatable, you must use a PRNG. An example is a large secret keystream for XOR encryption, generated (imperatively: identically) on both the transmit and receive side from a short common shared secret key.
What are the advantages of using PRNG over TRNG?
PRNGs can be portable to different computers and languages. Their implementations are easy to validate. They have a mathematical security definition, and it's easy to make fast PRNGs that experimentally match it (on the other hand, we don't know how to prove that).
TRNGs are not portable (they are not entirely software anyway), and are much more complex (typically there's a hardware source, tests of that at power-up and while in use, and a conditioning stage). It's hard to convince a neutral party that a TRNG works.
In practice, the best choice is almost always a Cryptographically Secure PRNG, seeded by a public constant when one wants repeatability, or seeded by the output of a TRNG (or a secret constant changed manually as needed, perhaps combined with a counter, or time from a truly strictly increasing reference) otherwise. The CSPRNG will mask any small imperfection of the TRNG there will be, and have a high throughput: modern CSPRNG are extremely fast (in the order of 10 CPU cycles per byte generated for Salsa20, which supports "skip-ahead").
-
$\begingroup$ "the best choice is almost always a Cryptographically Strong PRNG" That isn't really true. Crypto-strong PRNGs tend to be very expensive, which means they tend to be reserved for situations where security depends on them. In Monte Carlo algorithms where you need a lot of random numbers in a short space of time, for example, they are not very well suited. $\endgroup$– Pseudonym ♦Commented Mar 28, 2021 at 6:11
-
1$\begingroup$ @Pseudonym: Cryptographically Strong PRNGs have matured, and now are quite fast; like 10 cycles per byte for an assembly-language implementation, less than three times that in C. It's uncommon they are a botleneck. $\endgroup$– fgrieuCommented Mar 28, 2021 at 8:20
-
$\begingroup$ Interesting! A reference would be very helpful here. $\endgroup$– Pseudonym ♦Commented Mar 28, 2021 at 12:36
-
$\begingroup$ @Pseudonym: I added a reference. It's a bit dated (2005), because I wanted something that's truly portable. It sports 10.55 cycles/byte for Salsa20 on Intel Pentium M using 32-bit instructions available on most architectures. Newer references will tend to do much better on modern CPUs with SIMD instructions, or specialized ones like AESENC or SHA256RNDS2, but then we loose portability. When instantiated as an easily used CSPRNG, great care is needed so that the interface code does not kill the performance. $\endgroup$– fgrieuCommented Mar 28, 2021 at 15:03
-
$\begingroup$ Thank you for that. I did know about ChaCha20, and that it is an order of magnitude slower than general-purpose PRNGs under the same conditions. That certainly makes it competitive, as long as you don't need advanced features like skip-ahead. See, for example, pcg-random.org/other-rngs.html. $\endgroup$– Pseudonym ♦Commented Mar 29, 2021 at 1:20
$\begingroup$
$\endgroup$
2
In a word, no.
Even TRNGs carry artifacts from natural processes which must be filtered out by slow entropy polling, random polling, inversion and XOR from the same source but over two different time periods, using many such sources, and combinations of all of the above.
The time between Geiger counter ticks is an example of truly random events, created as they are from a billion billion radioactive atoms. It's literally slow entropy polling taken to the extreme! Although the times are analog, they can be made digital simply by comparing each interval to the preceding one. If it's longer, it's a 0. If it's shorter, it's a 1. By using an even number of multiple independent detectors and timers and XORing the streams, you'll arrive at a string of binary numbers which pass all current and conceivable tests of randomness.
You can achieve the same degree of randomness, however, even if you use fairly deterministic generators, such as those found in Excel, if you "randomize the random."
I've been doing so for several years, and at a rate of over 91 Mbps.
By the way, CSPRNG is not "Cryptographically Strong PRNG." It's "Cryptographically Secure Pseudo-Random Number Generator."
-
$\begingroup$ This does not answer the question. Output from generative AI suspected. $\endgroup$– DannyNiuCommented Aug 15, 2023 at 7:18
-
1$\begingroup$ "No" is a curious response to a "What are…" question. $\endgroup$ Commented Aug 16, 2023 at 8:57