2025-09-21 –, Tesla
Not all random numbers are created equal. It's easy to think our source of randomness is strong, or that it's hard to predict, when it's anything but. This talk explores how important randomness is to security, the (wrong) assumptions we may make about it, and why it's hard to get right: lessons PlayStation and many others learned the hard way.
The talk will focus on cryptographic properties of random number generators and the faults they may incur. The talk is aimed at beginners to cryptography, and will not be going over the actual mechanics of RNGs in too much detail.
Initially, the idea of randomness is presented. The properties we want (entropy, long periods, equidistributed, seeds) are briefly discussed, followed by a recap of popular PRNGs (LCGs, Mersenne) and the languages they're used by default in. We then talk about why these PRNGs are rather bad, with some real-world examples. We go over the PlayStation 3 RNG failure, poor RSA keygens (https://eprint.iacr.org/2012/064.pdf), and discuss how it's easier to attack the RNG than reverse-engineering the key proper.
The talk concludes by introducing CSPRNGs and the underlying primitives employed in them. Then we go over the current state-of-the-art and how modern cryptography is slowly trying to abandon PRNGs as a whole.
