> Personally, I don't believe in the "middle ground" of "difficult-to-predict-but-not-crypto": usually it just means it is so easy to break that nobody
https://github.com/rust-random/rand/issues/905#issuecomment-...
PCG's statistical quality is "excellent" but chacha20's just "good"?
- Vigna claims small differences in internal states don't have avalanche effects, and the rebuttal says those small differences in internal states don't occur normally, not with the proper seeding steps.
- Vigna claims to be able to predict one particular variant of PCG, and the rebuttal said that that was one of the weaker variants that specifically has "insecure" in the name.
It's persuasive to me in suggesting that Vigna's claims are perhaps not that clear cut.
I am not an expert in PRNG and I wouldn't say this makes PCG win over Xorshiro or not, I just think it's unfortunate that the issue above linked only one side of the argument, especially since I find the other side more pleasant to read.
Likewise, it's easy to invent another PRNG, but not so easy to figure out that, say, its output always falls on one of seventeen parallel planes when treated as consecutive (x, y, z) coordinates.
If you want random numbers that are fast and almost-cryptographically-strong, you can take some ARX block cipher and reduce number of rounds as you see fit. But it's not nearly as much fun.
> This was done after some concerns were raised by the author of xoshiro, who posted a blog entry on PCG and also raised an issue on the possibility of PCG being invertible.
PCG and the XOR family are both non-cryptographic RNGs, how is predictability or invertibility relevant then? If those are concerns, surely a CSPRNG should be used?
The "quality" of randomness is very much a concern in non-secure contexts e.g. patterns in an RNG can bias your simulation, but it doesn't seem like it'd matter if somebody can recover even your simulation seed.
This was always my complaint with PCG, that it talked about "difficulty to predict" and its suitability for... some kinds? of security applications? I don't know what those applications are, but somehow PCG targets them? If you care about this stuff, you should simply be using getrandom(2).
For what it's worth: I get why you'd want a high-quality generator of insecure random data (for simulations and stuff), and that there's an interesting discussion to have about what generator does the best job at handling that workload. I'm just saying it seems to have nothing to do with invertibility and crackability.