mardi 22 juin 2021

Why using a time-based pseudo-random number is not cryptographically secure?

It is well known that pseudo-random numbers are not cryptographically secure.

An extremely basic way I can think of generating a pseudo-random number could be to get the time-stamp at the time the code runs and return the lowest significant figures.

For example the outcome of import time; return time.time_ns/100 % 1000 returns a number between 0 and 1000 that should be almost impossible to predict unless you know exactly the time at wich the code run (with a nanosecond precision) and all the overhead execution times of the code.

We could then use one or more numbers generated this way to run a chaotic function (as a logistic map) to generate number that should be extemely hard to predict.

One extremely naive implementation could be:

import time

def random():
    return time.time_ns()/100 % 1000 / 1000

def logistic():
    r = 3.9 + random()/10
    N = 1000 + int(random()*100)
    x = random()
    
    for _ in range(N):
        x = r*x*(1-x)

    return x

print(logistic())

However, I'm quite sure that no one would consider this to be criptographycally secure. Why is this? How could one predict/attack such method?




Aucun commentaire:

Enregistrer un commentaire