兰德的质量（） [英] Quality of rand()
问题描述
可以告诉我为什么rand（）是一个如此糟糕的伪随机数发生器。
在我读过的所有文章中他们说你可以预测结果
of rand（）但当我使用NIST的随机数测试套件时输出它b / b
它随机传递所有测试。任何人都可以建议我可以使用它会失败的测试吗？指向合适的
文章的指针将不胜感激。
感谢您提前的帮助，
汤姆
-
使用M2，Opera的革命性电子邮件客户端： http://www.opera.com/m2/
Can any tell me why rand() is such a bad pseudo-random number generator.
In all the articles I have read they say that you can predict the outcome
of rand() but when I used its output with NIST''s random number testsuite
it passed all of the tests thrown at it for randomness. Can anyone
suggest a test I could use that it would fail? A pointer to a suitable
article would be appreciated.
Thanks for your help in advance,
Tom
--
Using M2, Opera''s revolutionary e-mail client: http://www.opera.com/m2/
推荐答案
汤姆麦卡勒姆 < TE ******** @ hotmail.com>在留言中写道
news：op ************** @ news.blueyonder.co.uk ...
"Tom McCallum" <te********@hotmail.com> wrote in message
news:op**************@news.blueyonder.co.uk...
可以告诉我为什么rand（）是一个如此糟糕的伪随机数生成器。
在我读过的所有文章中他们都说你可以预测rand（）的结果但是当我用NIST的输出时随机数testuite
它通过了所有的随机测试。任何人都可以建议我可以使用它会失败的测试吗？指向合适的
文章的指针将不胜感激。
Can any tell me why rand() is such a bad pseudo-random number generator.
In all the articles I have read they say that you can predict the outcome
of rand() but when I used its output with NIST''s random number testsuite
it passed all of the tests thrown at it for randomness. Can anyone
suggest a test I could use that it would fail? A pointer to a suitable
article would be appreciated.
您无法对兰特的质量做出一般性陈述，因为它的实际性能为b
和属性将从一个库实现到
其他。
但是根据经验，rand（）设计得很快并且使用简单的
线性同余发生器。从历史上看，也有很多
投诉，一些实现使用的LCG常数很差。
所以真正的问题是：你不能依赖rand（）产生好的质量
随机数。
有关LCG和其他随机数发生器的介绍，请参阅例如
http://www.taygeta.com/rwalks/node1.html ，或阅读Knuth''s TAOCP
http：// www-cs- faculty.stanford.edu/~knuth/taocp.html 。
游戏和许多休闲应用可以做到''可预测''
随机数生成器（RNG），但许多安全敏感的应用程序（网络协议，加密）需要真正的随机数源。我不熟悉您使用的NIST套件，
它是否会寻找吸引器和随机性等内容？
以下文章可能会提供一个有趣的插图
测试评估RNG的安全弱点：
http://lcamtuf.coredump.cx/newtcp/
hth -Ivan
-
http://ivan.vecerina.com/contact/?subject=NG_POST < - 电子邮件联系表格
You cannot make a general statement about the quality of rand, as its actual
performance and properties will vary from one library implementation to the
other.
But as a rule of thumb, rand() is designed to be fast and uses a simple
Linear Congruential Generator. Historically, there has also been many
complaints that the LCG constants used by some implementations were poor.
So the real problem is: you cannot rely on rand() producing good quality
random numbers.
For an intro to LCG and other random number generators, see for example
http://www.taygeta.com/rwalks/node1.html, or read Knuth''s TAOCP
http://www-cs-faculty.stanford.edu/~knuth/taocp.html.
Games and many casual applications can do with a ''predictable''
random number generator (RNG), but many security-sensitive
applications (network protocols, encryption) require truly
random sources. I''m not familiar with the NIST suite you used,
does it look for things such as attractors and bits of randomness?
The following article may provide an interesting illustration
of tests that evaluate the security weaknesses of a RNGs:
http://lcamtuf.coredump.cx/newtcp/
hth -Ivan
--
http://ivan.vecerina.com/contact/?subject=NG_POST <- e-mail contact form
2004年8月18日星期三11:28:20 +0200，Ivan Vecerina
< NO **********************************@vecerina.com>写道：
On Wed, 18 Aug 2004 11:28:20 +0200, Ivan Vecerina
<NO**********************************@vecerina.com > wrote:
" Tom McCallum" < TE ******** @ hotmail.com>在消息中写道
新闻：op ************** @ news.blueyonder.co.uk ...
"Tom McCallum" <te********@hotmail.com> wrote in message
news:op**************@news.blueyonder.co.uk...
可以告诉我为什么兰德（ ）是一个如此糟糕的伪随机数生成器。
在我读过的所有文章中，他们都说你可以预测rand（）的结果
但当我用NIST的输出时随机数testuite
它通过了所有的随机测试。任何人都可以建议我可以使用它会失败的测试吗？指向合适的
文章的指针将不胜感激。
Can any tell me why rand() is such a bad pseudo-random number generator.
In all the articles I have read they say that you can predict the
outcome
of rand() but when I used its output with NIST''s random number testsuite
it passed all of the tests thrown at it for randomness. Can anyone
suggest a test I could use that it would fail? A pointer to a suitable
article would be appreciated.
您无法对兰特的质量作出一般性陈述，因为其实际性能和属性会有所不同从一个库实现到
其他。
但是根据经验，rand（）设计得很快并且使用简单的线性同余生成器。从历史上看，也有很多人抱怨某些实现使用的LCG常数很差。
所以真正的问题是：你不能依赖rand（）产生高质量的随机数。
有关LCG和其他随机数生成器的介绍，请参阅例如
http://www.taygeta.com/rwalks/node1.html ，或阅读Knuth的TAOCP
http://www-cs-faculty.stanford.edu/~knuth/taocp.html 游戏和许多休闲应用程序可以使用可预测的随机数生成器（RNG），但许多安全敏感的应用程序（网络协议，加密）需要真正的随机来源。我不熟悉您使用的NIST套件，它是否会寻找吸引器和随机性等内容？
下面的文章可能会提供一个有趣的评估示例RNG的安全弱点：
http://lcamtuf.coredump.cx/ newtcp /
hth -Ivan
You cannot make a general statement about the quality of rand, as its
actual
performance and properties will vary from one library implementation to
the
other.
But as a rule of thumb, rand() is designed to be fast and uses a simple
Linear Congruential Generator. Historically, there has also been many
complaints that the LCG constants used by some implementations were poor.
So the real problem is: you cannot rely on rand() producing good quality
random numbers.
For an intro to LCG and other random number generators, see for example
http://www.taygeta.com/rwalks/node1.html, or read Knuth''s TAOCP
http://www-cs-faculty.stanford.edu/~knuth/taocp.html.
Games and many casual applications can do with a ''predictable''
random number generator (RNG), but many security-sensitive
applications (network protocols, encryption) require truly
random sources. I''m not familiar with the NIST suite you used,
does it look for things such as attractors and bits of randomness?
The following article may provide an interesting illustration
of tests that evaluate the security weaknesses of a RNGs:
http://lcamtuf.coredump.cx/newtcp/
hth -Ivan
感谢您的回复，在回答您的问题时，NIST套件使用了
以下测试：
[01]频率[02]块频率
[03]累积总和[04]运行
[05]最长的一次[06]等级
[07]离散傅立叶变换[08]非周期模板
匹配
[09 ]重叠模板匹配[10]通用统计
[11]近似熵[12]随机游览
[13]随机短途旅行变种[14]序列号
[15] Lempel-Ziv复杂性[16]线性复杂性
我不确定这些是否包括'吸引子和位随机性''但是因为我可以说它们似乎是一个合理的收藏品。
干杯
Tom
-
使用M2，Opera的革命性电子邮件客户端： http://www.opera.com/m2/
Tom McCallum写道：
Tom McCallum wrote:
可以告诉我为什么rand（）是一个如此糟糕的伪随机数
生成器。在我读过的所有文章中，他们都说你可以预测rand（）的结果，但是当我用NIST'的随机数testsuite
Can any tell me why rand() is such a bad pseudo-random number
generator. In all the articles I have read they say that you can
predict the outcome of rand() but when I used its output with NIST''s
random number testsuite
你混合了两件不同的东西。 rand（）的结果是可预测的纯粹原因，即它实现了一个确定性算法。从给定的起始配置（可能是未知的b $ b），它生成随机的数字并通过测试。
知道算法，它可以从几个结束给定
值，接下来会是什么，但是如果你认为rand（）是确定性的，那么属性预测
下一个数字有多难 br />
没有任何随机性测试检查（并且很难完成
，顺便说一句。），因为它不会起到通常目的的作用一个
随机生成器，单独的数字应该是随机的，这就足够了。
值得注意的例外是加密，其中真实是随机性是一个
安全问题。
Marco
You are mixing up two different things. The outcome of rand() is
predictable for the sheer reason, that it is implementing an
deterministic algorithm. From a given starting configuration (which may
be unknown) it generates number that look random and pass the tests.
Knowing the algorithm, it can be concluded from a couple of given
values, what will follow, but the property ''how hard is it to predict
the next number if you consider that rand() is deterministic'' is
nothing that a randomness test checks (and it would be too hard to be
done, btw.), because it doesn''t play a role for the usual purposes of a
random generator, the numbers alone should look random, that''s enough.
The notable exception is cryptography, where "real" randomness is a
security issue.
Marco
这篇关于兰德的质量（）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
