Re:Designing a New PRNG
by maqp on Monday December 20, 2021 @07:53PM
(#29632495)
It's great that insecure fast RNGs are improving, but it's extremely important to be responsible about how they should be promoted.
1. Insecurity needs to be in the name: Make it Insecure<Your RNG Name Here>. This is extremely important. Since the intended use-context is going to be non-security critical, anyway, it's actually good that it states it's insecure. That way you know you're not accidentally using RNG where security properties might cause any bottle-necks. At the same time the misuse resistance of the RNG increases significantly.
2. Make sure this is not default, but something that needs to be imported separately from non-security context, such as module about statistics, simulation etc.
1. Insecurity needs to be in the name: Make it Insecure<Your RNG Name Here>. This is extremely important. Since the intended use-context is going to be non-security critical, anyway, it's actually good that it states it's insecure. That way you know you're not accidentally using RNG where security properties might cause any bottle-necks. At the same time the misuse resistance of the RNG increases significantly.
2. Make sure this is not default, but something that needs to be imported separately from non-security context, such as module about statistics, simulation etc.