Cryptographically Secure Random Numbers

Many applications require "cryptographically secure" random numbers. The generally accepted criteria for cryptographically secure random numbers seems to be:

1. The random numbers should pass statistical tests of randomness.
2. It should be difficult to predict the output of the random number generator from observing some previous outputs of the random number generator.
3. It should be difficult to create the same operating conditions as the random generator and then duplicate previously produced output.

These issues tend to be of great concern when using a "pseudorandom" number generator: pseudorandom numbers are generated from a deterministic process and in fact, are not truly random. An appealing property of pseudorandom number generators is that the deterministic nature of the equations allow exact calculations of the level of difficulty of (2) or (3) above.

Unlike pseudo-random number generators in which data is known to be non-random and the question of cryptographic security is reduced to one of measuring a degree of difficulty, a true random number generator like Really Random Numbers always has an open question: "Are the numbers really random?"

If the underlying binary data used to produce to the numbers is truly random, i.e.:

• independent, identically distributed (i.i.d.) bit observations
• having zerocovariance across all bit observations
• probability of a ZERO bit occurring exactly equal to .500
• probability of a ONE bit occurring exactly equal to .500

then random numbers generated from this binary data are truly random, and they have no predictability so the required condition (2) of not being able to predict the output should be satisfied.

What about replication of the output by recreating operating conditions? Again, if the binary data is truly random according to the criteria above, recreation of the output is only possible by observing the EXACT same events as used to generate the data. By using real-time events based on physical phenomenon (audio sampling), it should be virtually impossible to reproduce the exact physical conditions for generating the same set of data twice. A hacker would have to recreate all the foreground and background noise, the exact readings of the decidedly imprecise analog-to-digital converter on the sound card, temperature and humidity conditions that affect the sound input, etc. Assuming that recreating these conditions is nearly impossible, condition (3) of not being able to reproduce output should be satisified.

Unlike a mathematical algorithm that can guarantee that the required properties are met to some known degree of difficulty, we cannot offer any mathematical proof that the numbers are in fact cryptographically secure or to what degree of difficulty. We can hypothesize:

• Null Hypothesis: Binary data generated by Really Random Numbers is truly random according to the definition above, and therefore: (1) passes all statistical tests of randomness, (2) cannot be predicted by any means, and (3) cannot practically be duplicated even by duplicating operating conditions. Under this hypothesis, the likelihood of being able to predict any sequence of N bits is never greater than 1/2^N for all values of N.

and we can test this Null Hypothesis against:

• Alternative Hypothesis: Null Hypothesis is not true.

We can run statistical tests to test the Null Hypothesis, and we can fail to reject it repeatedly more than would be predicted by the Type I Error of our statistical test. After many such tests we might reasonably draw a conclusion that the Null Hypothesis must be true at some high level of significance that approaches 100% certainty.

Any mathematical proof of cryptographic security of random numbers generated by Really Random Numbers would have to rely on the assumption that the generated data is truly random. It is up to you to decide whether you choose to believe that assumption - we can only help by offering a free Evaluation Edition so that you can test the Null Hypothesis on your hardware to your own satisfaction.