Cryptographic PRNG

A Cryptographic Pseudorandom Number Generator (PRNG) is an algorithm designed to produce sequences of numbers that are statistically indistinguishable from true random numbers, with the additional property of being computationally unpredictable. It is essential for security applications where randomness must be resistant to attacks, such as generating encryption keys, initialization vectors, and nonces. Unlike non-cryptographic PRNGs, cryptographic PRNGs are built to withstand attempts by adversaries to predict or reproduce their output.

Also known as: CSPRNG, Cryptographically Secure Pseudorandom Number Generator, Secure Random Number Generator, Cryptographic Random, Secure PRNG

Why learn Cryptographic PRNG?

Developers should learn and use cryptographic PRNGs when implementing security-sensitive features like encryption, authentication, and secure communication protocols, as they ensure that random values cannot be guessed or reverse-engineered by attackers. This is critical in applications such as SSL/TLS handshakes, password hashing with salts, and generating secure tokens to prevent vulnerabilities like predictable random number attacks. In contrast, non-cryptographic PRNGs (e.g., for simulations or games) are insufficient for these use cases due to their predictability.

Learning Resources

• docs: NIST Special Publication 800-90A: Recommendation for Random Number Generation Using Deterministic Random Bit Generators
• docs: Cryptographically Secure Pseudo-Random Number Generators (CSPRNG) - OWASP Cheat Sheet Series
• course: Random Number Generation - Cryptography I by Stanford University (Coursera)
• tutorial: Introduction to Cryptography - Chapter on Randomness (Khan Academy)
• video: Cryptographic Randomness on a Commodore 64 - Video by Computerphile