0

How good is blake3 for generating pseudo-random bitstrings in comparison to a random oracle?

Let's say we generated an arbitrarily long pseudo-random bitstring by concatenating blake3 hashes together in the following manner:

blake3(seed) || blake3(seed + 1) || blake3(seed + 2) || ... || blake3(seed + n)

How good (in terms of quality) would a block of random bits generated in this manner be?
I was extensively searching for any results of TestU01 (BigCrush), PractRand, Diehard, and NIST STS tests performed on a PRNG based on blake3, but I couldn't find anything. I would appreciate it if anyone could link me something or explain why this would/could/wouldn't be a good way to generate pseudo-random bits.

I'm not concerned about seed being public, backtracking, future prediction, speed, or anything but the quality of pseudorandom bits generated in this manner.

UPDATES:
Running NIST Statistical Test Suite on 1GB of blake3 concatenated hashes.
I gave up for today (took too long). Might try again tomorrow and post the results. I ran it on 10MB and it passed.

TypicalHog
  • 133
  • 9

1 Answers1

1

What you are asking is equivalent to asking how broken Blake3 is. If you can distinguish output of a cryptographic hash from a random oracle, it's considered broken[1].

The answer is that as far as anyone knows, it's not broken.

[1] https://en.wikipedia.org/wiki/Distinguishing_attack

LightTunnelEnd
  • 262
  • 1
  • 7