Random number generators

This is a briefing about Random Number Generators.
Random Number Generators are important in the data center because of their role in cryptography. This briefing introduces Random Number Generators, types of Random Number Generators including TRNG and PRNG, and a visual example of "randomness." http://boblandstrom.com

1. Random Number Generators

2. It all seems so random!
A cubical die is a random number generator. It’s a physical
random number generator that will give us a number
between one and six. Other simple random number
generators in our everyday lives are drawing from a deck of
cards and coin flipping.

• Still, with such simple methods, we have two issues.
• The first is that it’s not entirely unreasonable to guess the
outcome beforehand.
• The second is that the outcomes repeat fairly regularly.

3. Applications of Random Number Generators
Random Number Generators are used in a wide array of applications

• Gaming
• Statistical Analysis
• Simulation
• Weather prediction
• Medicine
• Radio communications
• Cryptography

… to name just a few!

How “random” is “random enough?”
What goes into selecting a random number generator?

4. Random Number Generators in the Data Center
Cryptography is an essential element for protection of data in motion, data at rest, and also
for data in use.

New legislation, such as the European Union’s General Data Protection Regulation (GDPR)
mandates privacy by design and encourages pseudonymization of all PII. Tokenization and
data encryption are steps on the path to compliance.

Random number generators are used in cryptography, and in particular for encryption keys
and tokenization.
• For encryption key use, random number generators are used to create seed values (or
starting values) from which the encryption algorithms will work.

5. Two Types of Random Number Generators
Let’s declare two categories of random number generators:

• Pseudo-Random Number Generators (PRNG)
• True Random Number Generators (TRNG)

As the name would suggest, PRNG’s are generally less random than are TRNG’s, but
there’s more than meets the eye.

6. Pseudo-Random Number Generators
PRNG’s generate random numbers using a mathematical algorithm or a list of numbers
precalculated beforehand.

• PRNG’s are said to be efficient because they can create the numbers very quickly and
with minimal computing resources.
• They are also said to be deterministic because a given sequence of numbers can be
reproduced at a later state if one knows the starting point of the sequence.
• They are also periodic
• That is, the sequence of random numbers will eventually repeat itself. Fortunately, the period is so long
that it can be ignored for most practical purposes, but it is a predictable behavior (not truly random).
• Note that there are lots of PRNG algorithms to choose from. The strength a given
algorithm can be quite high and there are lots of instances in which a PRNG is
“random enough.”

7. True Random Number Generators
TRNG’s draw from the randomness of some accessible physical phenomena for
generation of random numbers.

• Examples include radioactive decay, atmospheric noise, background (white) noise,
and electrical or quantum phenomena.
• There is no discernable pattern in true random number generation and they can be
counted on to produce something that is truly random.
• They are nondeterministic
• One would not be able to reproduce a given sequence of numbers.
• TRNG’s are better suited for encryption key generation.

8. Images of “Randomness”
Data pattern image from a TRNG
Data pattern image from a PRNG

9. A basis for encryption key generation
Random number generators are used in cryptography, and in particular for
encryption keys and tokenization.

For encryption key use, the more randomness the better, as that will translate into
difficulty in compromising the keys.

Random number generators are used to create seed values (or starting values) from
which the encryption algorithms will work.

Tokenization is an important function for pseudonymization, which is used to mask
or obscure personally identifiable information (PII). Pseudonymization is required
by certain compliance regulations protecting PII.

10. boblandstrom.com
@DataCenterBob
RUINED FOR ORDINARY...