1

From Definition of CSPRNG, it has two characteristics

  1. It satisfies the next-bit test.
  2. It withstands 'state compromise extensions' - part of all of the state being compromised does not allow for reconstruction of the prior stream of random numbers.

I am looking for PRNGs which fail the 2nd Characteristic. Infact they are PRNG but not CSPRNG.

crypt
  • 2,522
  • 22
  • 33

2 Answers2

4

Item (2) is not part of the definition of a standard CSPRNG. If you look at where this definition was taken from in Wikipedia, this item refers to a "forward secure CSPRNG". So, this is a definition of forward security and not the standard notion.

Also, the next-bit test is one way of defining, but certainly not the only way.

In any case, it is easy to construct a CSPRNG that is not forward secure; simply always store the initial state.

Yehuda Lindell
  • 28,270
  • 1
  • 69
  • 86
1

The ChaCha cipher is definitely not forward secure: the only state modification is to increment a counter.

dhardy
  • 111
  • 2