No Spook Leaves Randomness to Chance
Examines historical vulnerabilities in cryptographic random number generator standards and explores how flawed algorithms have been introduced into public specifications.
Summary
The Critical Role of Cryptographic Randomness
Cryptographic systems fundamentally rely on unpredictable random number generators (RNGs) for generating cryptographic keys, nonces, and session tokens. When the underlying randomness is predictable or compromised, all dependent security protocols collapse.
Vulnerabilities in Vetted Cryptographic Standards
Over the past two decades, security researchers have uncovered subtle vulnerabilities in widely standardized RNG algorithms. Even algorithms vetted by standard bodies have exhibited predictable internal states or mathematical weaknesses that degrade entropy.
Adversarial Manipulation of Standards
Historical analysis reveals instances where subtle mathematical structures or state-transition parameters were intentionally introduced into standards, enabling covert decryption by actors with private knowledge of the algorithm's construction.
Ensuring Robust Entropy and Verification
Mitigating subtle cryptographic backdoors requires open, peer-reviewed standards processes, transparent parameter generation, and rigorous mathematical verification of random bit generation algorithms.
Related talks
Crypto and Privacy Village·23 min
Emily Fane · Abdel Sy Fane
Introduces the Quantum Readiness Assurance Maturity Model (QRAMM), an open-source framework assessing organizational agility for post-quantum migrations.
Crypto and Privacy Village·45 min
EFF Senior Staff Attorney Nate Cardozo provides a legal briefing on legislative battles, court rulings, and government backdoors targeting encryption.
Creator Stage·37 min
Jordan Kasper
Discusses the adoption, governance, and policy landscape of open-source software within US federal agencies and defense departments.


