Paper 2022/558

On Seedless PRNGs and Premature Next

Sandro Coretti, Yevgeniy Dodis, Harish Karthikeyan, Noah Stephens-Davidowitz, and Stefano Tessaro

Abstract

Pseudorandom number generators with input (PRNGs) are cryptographic algorithms that generate pseudorandom bits from accumulated entropic inputs (e.g., keystrokes, interrupt timings, etc.). This paper studies in particular PRNGs that are secure against premature next attacks (Kelsey et al., FSE '98), a class of attacks leveraging the fact that a PRNG may produce an output (which could be seen by an adversary!) before enough entropy has been accumulated. Practical designs adopt either unsound entropy-estimation methods to prevent such attacks (as in Linux's /dev/random) or sophisticated pool-based approaches as in Yarrow (MacOS/FreeBSD) and Fortuna (Windows). The only prior theoretical study of premature next attacks (Dodis et al., Algorithmica '17) considers either a seeded setting or assumes a constant entropy rate, and thus falls short of providing and validating practical designs. Assuming the availability of random seed is particularly problematic, first because this requires us to somehow generate a random seed without using our PRNG, but also because we must ensure that the entropy inputs to the PRNG remain independent of the seed. Indeed, all practical designs are seedless. However, prior works on seedless PRNGs (Coretti et al., CRYPTO '19; Dodis et al., ITC '21, CRYPTO'21) do not consider premature next attacks. The main goal of this paper is to investigate the feasibility of theoretically sound seedless PRNGs that are secure against premature next attacks. To this end, we make the following contributions: -- We prove that it is impossible to achieve seedless PRNGs that are secure against premature-next attacks, even in a rather weak model. Namely, the impossibility holds even when the entropic inputs to the PRNG are independent. In particular, our impossibility result holds in settings where seedless PRNGs are otherwise possible. -- Given the above impossibility result, we investigate whether existing seedless pool-based approaches meant to overcome premature next attacks in practical designs provide meaningful guarantees in certain settings. Specifically, we show the following. * We introduce a natural condition on the entropic input and prove that it implies security of the round-robin entropy accumulation PRNG used by Windows 10, called Fortuna. Intuitively, our condition requires the input entropy ``not to vary too wildly'' within a given round-robin round. * We prove that the ``root pool'' approach (also used in Windows 10) is secure for general entropy inputs, provided that the system's state is not compromised after system startup.

Note: Minor re-organization of proofs

Metadata
Available format(s)
PDF
Category
Foundations
Publication info
Published elsewhere. MINOR revision.ITC 2022
Keywords
Mathematical foundations of cryptographyInformation-theoretic techniquesPseudorandomness and derandomizationseedless PRNGpremature nextroot PRNG
Contact author(s)
harish @ nyu edu
History
2022-05-10: revised
2022-05-10: received
See all versions
Short URL
https://ia.cr/2022/558
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2022/558,
      author = {Sandro Coretti and Yevgeniy Dodis and Harish Karthikeyan and Noah Stephens-Davidowitz and Stefano Tessaro},
      title = {On Seedless PRNGs and Premature Next},
      howpublished = {Cryptology ePrint Archive, Paper 2022/558},
      year = {2022},
      note = {\url{https://eprint.iacr.org/2022/558}},
      url = {https://eprint.iacr.org/2022/558}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.