Cryptanalytic Attacks on Pseudorandom Number Generators

  • John Kelsey
  • Bruce Schneier
  • David Wagner
  • Chris Hall
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 1372)


In this paper we discuss PRNGs: the mechanisms used by real-world secure systems to generate cryptographic keys, initialization vectors, “random” nonces, and other values assumed to be random. We argue that PRNGs are their own unique type of cryptographic primitive, and should be analyzed as such. We propose a model for PRNGs, discuss possible attacks against this model, and demonstrate the applicability of the model (and our attacks) to four real-world PRNGs. We close with a discussion of lessons learned about PRNG design and use, and a few open questions.


Hash Function Block Cipher Stream Cipher Pseudorandom Number Generator Entropy Sample 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. Agn88.
    G.B. Agnew, “Random Source for Cryptographic Systems,” Advances in Cryptology — EUROCRYPT’ 87 Proceedings, Springer-Verlag, 1988, pp. 77–81.Google Scholar
  2. ANSI85.
    ANSI X 9.17 (Revised), “American National Standard for Financial Institution Key Management (Wholesale),” American Bankers Association, 1985.Google Scholar
  3. Bal96.
    R.W. Baldwin, “Proper Initialization for the BSAFE Random Number Generator,” RSA Laboratories Bulletin, n. 3, 25 Jan 1996.Google Scholar
  4. Dai97.
  5. DIF94.
    D. Davis, R. Ihaka, and P. Fenstermacher, “Cryptographic Randomness from Air Turbulience in Disk Drives,” Advances in Cryptology — CRYPTO’ 94 Proceedings, Springer-Verlag, 1994, pp. 114–120.Google Scholar
  6. ECS94.
    D. Eastlake, S.D. Crocker, and J.I. Schiller, “Randomness Requirements for Security,” RFC 1750, Internet Engineering Task Force, Dec. 1994.Google Scholar
  7. FMK85.
    R.C. Fairchild, R.L. Mortenson, and K.B. Koulthart, “An LSI Random Number Generator (RNG),” Advances in Cryptology: Proceedings of CRYPTO’ 84, Springer-Verlag, 1985, pp. 203–230.Google Scholar
  8. Gud85.
    M. Gude, “Concept for a High-Performance Random Number Generator Based on Physical Random Noise,” Frequenz, v. 39, 1985, pp. 187–190.Google Scholar
  9. Gut98.
    P. Gutmann, “Software Generation of Random Numbers for Cryptographic Purposes,” Proceedings of the 1998 Usenix Security Symposium, 1998, to appear.Google Scholar
  10. Koc95.
    P. Kocher, post to sci.crypt Internet newsgroup (, 4 Dec 1995.Google Scholar
  11. LMS93.
    J.B. Lacy, D.P. Mitchell, and W.M. Schell, “CryptoLib: Cryptography in Software,” USENIX Security Symposium IV Proceedings, USENIX Association, 1993, pp. 237–246.Google Scholar
  12. NIST92.
    National Institute for Standards and Technology, “Key Management Using X9.17,” NIST FIPS PUB 171, U.S. Department of Commerce, 1992.Google Scholar
  13. NIST93.
    National Institute for Standards and Technology, “Secure Hash Standard,” NIST FIPS PUB 180, U.S. Department of Commerce, 1993.Google Scholar
  14. NIST94.
    National Institute for Standards and Technology, “Digital Signature Standard,” NIST FIPS PUB 186, U.S. Department of Commerce, 1994.Google Scholar
  15. OW95.
    P.C. van Oorschot and M.J. Wiener, “Parallel collision search with application to hash function and discrete logarithms,” 2nd ACM Conf. on Computer and Communications Security, New York, NY, ACM, 1994.Google Scholar
  16. OW96.
    P.C. van Oorschot and M.J. Wiener, “Improving implementable meet-in-the-middle attacks by orders of magnitude,” CRYPTO’ 96, Springer-Verlag, 1996.Google Scholar
  17. Plu94.
    C. Plumb, “Truly Random Numbers, Dr. Dobbs Journal, v. 19, n. 13, Nov 1994, pp. 113–115.Google Scholar
  18. Ric92.
    M. Richterm “Ein Rauschgenerator zur Gweinnung won quasi-idealen Zufallszahlen fur die stochastische Simulation,” Ph.D. dissertation, Aachen University of Technology, 1992. (In German.)Google Scholar
  19. RSA94.
    RSA Laboratories, RSAREF cryptographic library, Mar 1994,
  20. SV86.
    M. Santha and U.V. Vazirani, “Generating Quasi-Random Sequences from Slightly Random Sources,” Journal of Computer and System Sciences, v. 33, 1986, pp. 75–87.zbMATHCrossRefMathSciNetGoogle Scholar
  21. Sch96.
    B. Schneier, Applied Cryptrography, John Wiley & Sons, 1996.Google Scholar
  22. Zim95.
    P. Zimmermann, The Official PGP User’s Guide, MIT Press, 1995.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 1998

Authors and Affiliations

  • John Kelsey
    • 1
  • Bruce Schneier
    • 1
  • David Wagner
    • 2
  • Chris Hall
    • 1
  1. 1.Counterpane SystemsUSA
  2. 2.University of California BerkeleyBerkeley

Personalised recommendations