为什么 Java 中的 SecureRandom 称为 CS PRNG 而不是 TRNG? [英] Why is SecureRandom in Java called CS PRNG and not TRNG?

问题描述

SecureRandom 内部使用其他算法，例如在 Linux 的情况下，使用 NativePRNG 而后者又使用 /dev/urandom .但是 /dev/urandom 实际上是使用中断事件等来生成类似于真随机数生成器 (TRNG) 的熵.那么为什么 SecureRandom 被称为 PseudoRandom Number Generator ，尽管它依赖于它所使用的算法的实现?

SecureRandom internally makes use of other algorithms , like in case of Linux , makes use of NativePRNG which in turn makes use of /dev/urandom . But /dev/urandom is actually using interrupts events etc to generate entropy which is similar to a True Random Number Generator (TRNG) . So why is SecureRandom called PseudoRandom Number Generator , although it is dependent on the implementation of the algorithm it is using ?

谢谢

推荐答案

我认为这与保证有关./dev/urandom 的保证是，如果有，它会使用随机数据，必要时填充伪随机数据以避免阻塞.因此，如果您使用 /dev/urandom，则不能声称真正的随机性，即使有时您会得到它.

I expect it has to do with guarantees. The guarantee of /dev/urandom is that it will use random data if available, filling in with pseudo-random data if necessary to avoid blocking. So if you're using /dev/urandom, you can't claim true randomness, even if sometimes you're getting it.

在 SecureRandom 的文档中它说:

许多 SecureRandom 实现采用伪随机数生成器 (PRNG) 的形式，这意味着它们使用确定性算法从真随机种子生成伪随机序列.其他实现可能会产生真正的随机数，而其他实现可能会结合使用这两种技术.

Many SecureRandom implementations are in the form of a pseudo-random number generator (PRNG), which means they use a deterministic algorithm to produce a pseudo-random sequence from a true random seed. Other implementations may produce true random numbers, and yet others may use a combination of both techniques.

因此，如果允许任何实现这样做，SecureRandom 的保证只能是它以伪随机方式工作.它也许可以做得更好，但这不是合同.

Thus, the guarantee of SecureRandom can only ever be that it works pseudo-randomly, if any implementations are allowed to do so. It may be able to do better, but that's not the contract.

这篇关于为什么 Java 中的 SecureRandom 称为 CS PRNG 而不是 TRNG?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！