Skip to content

No Spook Leaves Randomness to Chance

Shaanan Cohney

Examines historical vulnerabilities in cryptographic random number generator standards and explores how flawed algorithms have been introduced into public specifications.

Summary

The Critical Role of Cryptographic Randomness

Cryptographic systems fundamentally rely on unpredictable random number generators (RNGs) for generating cryptographic keys, nonces, and session tokens. When the underlying randomness is predictable or compromised, all dependent security protocols collapse.

Vulnerabilities in Vetted Cryptographic Standards

Over the past two decades, security researchers have uncovered subtle vulnerabilities in widely standardized RNG algorithms. Even algorithms vetted by standard bodies have exhibited predictable internal states or mathematical weaknesses that degrade entropy.

Adversarial Manipulation of Standards

Historical analysis reveals instances where subtle mathematical structures or state-transition parameters were intentionally introduced into standards, enabling covert decryption by actors with private knowledge of the algorithm's construction.

Ensuring Robust Entropy and Verification

Mitigating subtle cryptographic backdoors requires open, peer-reviewed standards processes, transparent parameter generation, and rigorous mathematical verification of random bit generation algorithms.

Related talks