A cryptographically secure pseudorandom number generator for Julia JuliCha (ChaCha.jl): A cryptographically secure pseudorandom number generator for Julia Adam Sealfon

Random numbers in computing Modeling and simulation Optimization Randomized algorithms Approximation algorithms Primality testing Games, e.g. poker Cryptography

Pseudorandom number generators (PRNGs) True randomness is expensive or limited PRNGs take a short random seed and expand it to produce a long sequence of bits that “look random” Programs can use this instead of true randomness The sequence should have the same statistical properties as a random sequence, e.g.: Roughly equal number of 0s and 1s Short substrings are repeated with the expected probability Ascending and descending sequences should occur in the right pattern Random binary matrices should have high rank etc.

The need for better pseudorandomness For some applications it’s not enough for PRNG output to have the same statistical properties as a random string We want it to be impossible to distinguish from true randomness E.g. Poker, cryptography Poor design or buggy implementations of PRNGs has led to cryptographic breaks

Cryptographically secure PRNGs (CS-PRNGs) No efficient program should be able to tell whether it is given PRNG output or truly random bits Equivalently, having seen many bits of the output, no efficient program should be able to guess the next bit more than 50% of the time Indistinguishable from true randomness, so safe to use for cryptography More complicated than ordinary PRNGs, so they tend to be slower

PRNGs in Julia AbstractRNG MersenneTwister ChaCha CS-PRNG LCG is the old standard. Imperfect, but good enough for many practical purposes. MersenneTwister predictable after 624 iterations Linear Congruential Generator

PRNGs in Julia AbstractRNG MersenneTwister JuliCha LCG is the old standard. Imperfect, but good enough for many practical purposes. Linear Congruential Generator

The ChaCha CS-PRNG State consists of 16 32-bit words Constants State consists of 16 32-bit words From initial configuration, apply transformation via a sequence of additions, bit shifts, and xors For each counter value, extract 512 pseudorandom bits. Then increment counter. Key Counter Nonce

The ChaCha CS-PRNG Relatively fast Easy to parallelize Constants Relatively fast Easy to parallelize Can be used as a stream cipher for encryption Adopted by Google as the basis for MACs in OpenSSL Key Counter Nonce

The U01 Test suite Runs a series of statistical tests on PRNG output Implemented in Julia package RNGTest.jl JuliCha and MersenneTwister passed all smallCrush tests LCG behaved variably depending on parameters

Runtime of ChaCha vs. MersenneTwister

Runtime of ChaCha vs. C libcrypto wrapper Not shown: wrapper for system call to /dev/urandom

Runtime of ChaCha vs. C libcrypto wrapper

Median time to produce 1000 UInt32s Mersenne Twister ChaCha C libcrypto wrapper OS /dev/ urandom 3.19 μs 271.64 μs 1.4 ms 6.8 s 85x faster - 5x slower 25,000x slower

Encryption using JuliCha