Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Designing a New PRNG

tom-kaitchuck.medium.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Designing a New PRNG

#11

Post by [deleted] »

jcranmer wrote: post #5
tptacek wrote: post #2

This is all pretty confusing to me, because it's discussing a non-cryptographic RNG but talking about invertibility and "having been cracked" as a motivation for replacing that RNG. If you need a secure RNG, you use a CSPRNG. For all other cases: why is "having been cracked" motivating? This was always my complaint with PCG, that it talked about "difficulty to predict" and its suitability for... some kinds? of securi…

From what I understand of the matter, the crux of it is that there are two modern PRNG families whose creators are running around telling you to use their PRNG over the other's because , where a) both of them are correct, and b) the don't elucidate the tradeoffs being made to people whose prior understanding amounts to "I just want a source of random numbers!" This is contrast to something like a linear congruential…

[deleted]

Re: Designing a New PRNG

#12

Post by loeg »

tptacek wrote: post #2

This is all pretty confusing to me, because it's discussing a non-cryptographic RNG but talking about invertibility and "having been cracked" as a motivation for replacing that RNG. If you need a secure RNG, you use a CSPRNG. For all other cases: why is "having been cracked" motivating? This was always my complaint with PCG, that it talked about "difficulty to predict" and its suitability for... some kinds? of securi…

I agree that the motivation is pretty confused. One of the straightforward goals is to be faster than PCG-64 or xoshiro256++ -- that seems reasonable.

Re: Designing a New PRNG

#13

Post by spekcular »

Dumb question: Why not just use AES? Most platforms have hardware acceleration so it should be pretty fast. Then there's no worrying about output quality.

(Is there an application for which AES is not fast enough? Has it been benchmarked for speed against the various PRNG options?)

Re: Designing a New PRNG

#14

Post by omoikane »

zokier wrote: post #9
tptacek wrote: post #2

This is all pretty confusing to me, because it's discussing a non-cryptographic RNG but talking about invertibility and "having been cracked" as a motivation for replacing that RNG. If you need a secure RNG, you use a CSPRNG. For all other cases: why is "having been cracked" motivating? This was always my complaint with PCG, that it talked about "difficulty to predict" and its suitability for... some kinds? of securi…

Seems that vigna (author of the xoshiro family of rngs) mostly agrees with you > Personally, I don't believe in the "middle ground" of "difficult-to-predict-but-not-crypto": usually it just means it is so easy to break that nobody https://github.com/rust-random/rand/issues/905#issuecomment-...

I wish that issue would also link to the rebuttal: https://www.pcg-random.org/posts/on-vignas-pcg-critique.html

Re: Designing a New PRNG

#16

Post by jandrewrogers »

spekcular wrote: post #13

Dumb question: Why not just use AES? Most platforms have hardware acceleration so it should be pretty fast. Then there's no worrying about output quality. (Is there an application for which AES is not fast enough? Has it been benchmarked for speed against the various PRNG options?)

Portability, most likely. I've seen AES-NI used as a convenient and fast PRNG but it would be a pretty sub-optimal choice for hardware platforms that don't have hardware acceleration.

Re: Designing a New PRNG

#17

Post by foxfluff »

matthewdgreen wrote: post #15

Seriously. Cut this shit out. Design a cryptographic RNG or decide precisely how you intend to justify a non-cryptographic RNG that has cryptographic security properties (but like, not all of them.)

If you want to design a cryptographic RNG that falls between LCGs and PCG in speed, please have a go at it. Meanwhile we'll use our small and fast PRNGs and strive to make them as good as they can possibly be for non-cryptographic uses.

Re: Designing a New PRNG

#18

Post by matthewdgreen »

foxfluff wrote: post #17
matthewdgreen wrote: post #15

Seriously. Cut this shit out. Design a cryptographic RNG or decide precisely how you intend to justify a non-cryptographic RNG that has cryptographic security properties (but like, not all of them.)

If you want to design a cryptographic RNG that falls between LCGs and PCG in speed, please have a go at it. Meanwhile we'll use our small and fast PRNGs and strive to make them as good as they can possibly be for non-cryptographic uses.

I beg you to define what “good” means in a way that doesn’t imply security properties. And if you must demand security properties, god help you if you designed something that can’t provide them.

Re: Designing a New PRNG

#19

Post by dogecoinbase »

foxfluff wrote: post #17
matthewdgreen wrote: post #15

Seriously. Cut this shit out. Design a cryptographic RNG or decide precisely how you intend to justify a non-cryptographic RNG that has cryptographic security properties (but like, not all of them.)

If you want to design a cryptographic RNG that falls between LCGs and PCG in speed, please have a go at it. Meanwhile we'll use our small and fast PRNGs and strive to make them as good as they can possibly be for non-cryptographic uses.

Saving some weight by leaving the airbag out of your car doesn't mean that it going faster is a good thing.

Re: Designing a New PRNG

#20

Post by foxfluff »

dogecoinbase wrote: post #19
foxfluff wrote: post #17

Earlier quoted context omitted.

If you want to design a cryptographic RNG that falls between LCGs and PCG in speed, please have a go at it. Meanwhile we'll use our small and fast PRNGs and strive to make them as good as they can possibly be for non-cryptographic uses.

Saving some weight by leaving the airbag out of your car doesn't mean that it going faster is a good thing.

So did PCG or xoroshiro leave the airbag out of MCGs or what? Or are you one of those who pretend that there was never any legitimate use case for any non-cryptographic PRNG?
Post reply on HN