Generación de números aleatorios

Este artículo necesita citas adicionales para su verificación . Por favor, ayuda a mejorar este artículo mediante la adición de citas de fuentes confiables . El material no obtenido puede ser cuestionado y eliminado. Buscar fuentes:  "Generación de números aleatorios"  -  noticias  · periódicos  · libros  · académico  · JSTOR ( junio de 2009 ) ( Aprenda cómo y cuándo eliminar este mensaje de plantilla )

Producing a sequence that cannot be predicted better than by random chance

Los dados son un ejemplo de un generador de números aleatorios de hardware mecánico. Cuando se lanza un dado cúbico, se obtiene un número aleatorio del 1 al 6.

La generación de números aleatorios es un proceso que, a menudo por medio de un generador de números aleatorios ( RNG ), genera una secuencia de números o símbolos que no se pueden predecir razonablemente mejor que mediante una probabilidad aleatoria . Los generadores de números aleatorios pueden ser generadores de números aleatorios de hardware verdaderamente aleatorios (HRNGS), que generan números aleatorios en función del valor actual de algún atributo del entorno físico que cambia constantemente de una manera prácticamente imposible de modelar, o generadores de números pseudoaleatorios ( PRNGS), que generan números que parecen aleatorios, pero en realidad son deterministas, y pueden reproducirse si se conoce el estado del PRNG.

Varias aplicaciones de la aleatoriedad han llevado al desarrollo de varios métodos diferentes para generar datos aleatorios , algunos de los cuales han existido desde la antigüedad, entre cuyas filas se encuentran ejemplos "clásicos" bien conocidos, como el lanzamiento de dados , el lanzamiento de monedas , el barajado de jugar a las cartas , el uso de tallos de milenrama (para la adivinación ) en el I Ching, así como innumerables otras técnicas. Debido a la naturaleza mecánica de estas técnicas, generar grandes cantidades de números suficientemente aleatorios (importantes en estadística) requirió mucho trabajo y tiempo. Por lo tanto, los resultados a veces se recopilarían y distribuirían como tablas de números aleatorios .

Existen varios métodos computacionales para la generación de números pseudoaleatorios. Todos no alcanzan el objetivo de la verdadera aleatoriedad, aunque pueden cumplir, con éxito variable, algunas de las pruebas estadísticas de aleatoriedad destinadas a medir qué tan impredecibles son sus resultados (es decir, hasta qué punto sus patrones son discernibles). Por lo general, esto los hace inutilizables para aplicaciones como la criptografía . Sin embargo, también existen generadores de números pseudoaleatorios criptográficamente seguros (CSPRNGS) cuidadosamente diseñados , con características especiales diseñadas específicamente para su uso en criptografía.

Aplicaciones y usos prácticos

Artículo principal: Aplicaciones de la aleatoriedad

Los generadores de números aleatorios tienen aplicaciones en juegos de azar , muestreo estadístico , simulación por computadora , criptografía , diseño completamente aleatorio y otras áreas donde es deseable producir un resultado impredecible. Generalmente, en aplicaciones que tienen la imprevisibilidad como característica primordial, como en las aplicaciones de seguridad, los generadores de hardware se prefieren generalmente a los algoritmos pseudoaleatorios, cuando es factible.

Los generadores de números pseudoaleatorios son muy útiles en el desarrollo de simulaciones del método Monte Carlo , ya que la depuración se ve facilitada por la capacidad de ejecutar la misma secuencia de números aleatorios nuevamente partiendo de la misma semilla aleatoria . También se utilizan en criptografía, siempre que la semilla sea ​​secreta. El remitente y el receptor pueden generar el mismo conjunto de números automáticamente para usarlos como claves.

La generación de números pseudoaleatorios es una tarea importante y común en la programación de computadoras. Si bien la criptografía y ciertos algoritmos numéricos requieren un grado muy alto de aleatoriedad aparente , muchas otras operaciones solo necesitan una cantidad modesta de imprevisibilidad. Algunos ejemplos simples podrían ser presentar a un usuario una "cita aleatoria del día" o determinar en qué dirección podría moverse un adversario controlado por computadora en un juego de computadora. Se utilizan formas más débiles de aleatoriedad en algoritmos hash y en la creación de algoritmos de búsqueda y clasificación amortizados .

Some applications which appear at first sight to be suitable for randomization are in fact not quite so simple. For instance, a system that "randomly" selects music tracks for a background music system must only appear random, and may even have ways to control the selection of music: a true random system would have no restriction on the same item appearing two or three times in succession.

"True" vs. pseudo-random numbers

Main articles: Pseudorandom number generator and Hardware random number generator

See also: Cryptographically secure pseudorandom number generator

There are two principal methods used to generate random numbers. The first method measures some physical phenomenon that is expected to be random and then compensates for possible biases in the measurement process. Example sources include measuring atmospheric noise, thermal noise, and other external electromagnetic and quantum phenomena. For example, cosmic background radiation or radioactive decay as measured over short timescales represent sources of natural entropy.

The speed at which entropy can be harvested from natural sources is dependent on the underlying physical phenomena being measured. Thus, sources of naturally occurring "true" entropy are said to be blocking – they are rate-limited until enough entropy is harvested to meet the demand. On some Unix-like systems, including most Linux distributions, the pseudo device file /dev/random will block until sufficient entropy is harvested from the environment.^[1] Due to this blocking behavior, large bulk reads from /dev/random, such as filling a hard disk drive with random bits, can often be slow on systems that use this type of entropy source.

The second method uses computational algorithms that can produce long sequences of apparently random results, which are in fact completely determined by a shorter initial value, known as a seed value or key. As a result, the entire seemingly random sequence can be reproduced if the seed value is known. This type of random number generator is often called a pseudorandom number generator. This type of generator typically does not rely on sources of naturally occurring entropy, though it may be periodically seeded by natural sources. This generator type is non-blocking, so they are not rate-limited by an external event, making large bulk reads a possibility.

Some systems take a hybrid approach, providing randomness harvested from natural sources when available, and falling back to periodically re-seeded software-based cryptographically secure pseudorandom number generators (CSPRNGs). The fallback occurs when the desired read rate of randomness exceeds the ability of the natural harvesting approach to keep up with the demand. This approach avoids the rate-limited blocking behavior of random number generators based on slower and purely environmental methods.

While a pseudorandom number generator based solely on deterministic logic can never be regarded as a "true" random number source in the purest sense of the word, in practice they are generally sufficient even for demanding security-critical applications. Indeed, carefully designed and implemented pseudorandom number generators can be certified for security-critical cryptographic purposes, as is the case with the yarrow algorithm and fortuna. The former is the basis of the /dev/random source of entropy on FreeBSD, AIX, OS X, NetBSD, and others. OpenBSD uses a pseudorandom number algorithm known as arc4random.^[2]

In October 2019, it was noted that the introduction of quantum random number generators (QRNGs) to machine learning models including neural networks and convolutional neural networks for random initial weight distribution and random forests for splitting processes had a profound effect on their ability when compared to the classical method of pseudorandom number generators (PRNGs).^[3]

Generation methods

Physical methods

Main article: Hardware random number generator

The earliest methods for generating random numbers, such as dice, coin flipping and roulette wheels, are still used today, mainly in games and gambling as they tend to be too slow for most applications in statistics and cryptography.

A physical random number generator can be based on an essentially random atomic or subatomic physical phenomenon whose unpredictability can be traced to the laws of quantum mechanics. Sources of entropy include radioactive decay, thermal noise, shot noise, avalanche noise in Zener diodes, clock drift, the timing of actual movements of a hard disk read-write head, and radio noise. However, physical phenomena and tools used to measure them generally feature asymmetries and systematic biases that make their outcomes not uniformly random. A randomness extractor, such as a cryptographic hash function, can be used to approach a uniform distribution of bits from a non-uniformly random source, though at a lower bit rate.

The appearance of wideband photonic entropy sources, such as optical chaos and amplified spontaneous emission noise, greatly aid the development of the physical random number generator. Among them, optical chaos^[4][5] has a high potential to physically produce high-speed random numbers due to its high bandwidth and large amplitude. A prototype of a high speed, real-time physical random bit generator based on a chaotic laser was built in 2013.^[6]

Various imaginative ways of collecting this entropic information have been devised. One technique is to run a hash function against a frame of a video stream from an unpredictable source. Lavarand used this technique with images of a number of lava lamps. HotBits measures radioactive decay with Geiger–Muller tubes,^[7] while Random.org uses variations in the amplitude of atmospheric noise recorded with a normal radio.

Demonstration of a simple random number generator based on where and when a button is clicked

Another common entropy source is the behavior of human users of the system. While people are not considered good randomness generators upon request, they generate random behavior quite well in the context of playing mixed strategy games.^[8] Some security-related computer software requires the user to make a lengthy series of mouse movements or keyboard inputs to create sufficient entropy needed to generate random keys or to initialize pseudorandom number generators.^[9]

Computational methods

Most computer generated random numbers use PRNGs which are algorithms that can automatically create long runs of numbers with good random properties but eventually the sequence repeats (or the memory usage grows without bound). These random numbers are fine in many situations but are not as random as numbers generated from electromagnetic atmospheric noise used as a source of entropy.^[10] The series of values generated by such algorithms is generally determined by a fixed number called a seed. One of the most common PRNG is the linear congruential generator, which uses the recurrence

${\displaystyle X_{n+1}=(aX_{n}+b)\,{\textrm {mod}}\,m}$

to generate numbers, where a, b and m are large integers, and ${\displaystyle X_{n+1}}$ is the next in X as a series of pseudorandom numbers. The maximum number of numbers the formula can produce is one less than the modulus, m-1. The recurrence relation can be extended to matrices to have much longer periods and better statistical properties .^[11]To avoid certain non-random properties of a single linear congruential generator, several such random number generators with slightly different values of the multiplier coefficient, a, can be used in parallel, with a "master" random number generator that selects from among the several different generators.^{[citation needed]}

A simple pen-and-paper method for generating random numbers is the so-called middle square method suggested by John von Neumann. While simple to implement, its output is of poor quality. It has a very short period and severe weaknesses, such as the output sequence almost always converging to zero. A recent innovation is to combine the middle square with a Weyl sequence. This method produces high quality output through a long period. See Middle Square Weyl Sequence PRNG.

Most computer programming languages include functions or library routines that provide random number generators. They are often designed to provide a random byte or word, or a floating point number uniformly distributed between 0 and 1.

The quality i.e. randomness of such library functions varies widely from completely predictable output, to cryptographically secure. The default random number generator in many languages, including Python, Ruby, R, IDL and PHP is based on the Mersenne Twister algorithm and is not sufficient for cryptography purposes, as is explicitly stated in the language documentation. Such library functions often have poor statistical properties and some will repeat patterns after only tens of thousands of trials. They are often initialized using a computer's real time clock as the seed, since such a clock generally measures in milliseconds, far beyond the person's precision. These functions may provide enough randomness for certain tasks (for example video games) but are unsuitable where high-quality randomness is required, such as in cryptography applications, statistics or numerical analysis.^{[citation needed]}

Much higher quality random number sources are available on most operating systems; for example /dev/random on various BSD flavors, Linux, Mac OS X, IRIX, and Solaris, or CryptGenRandom for Microsoft Windows. Most programming languages, including those mentioned above, provide a means to access these higher quality sources.

Generation from a probability distribution

There are a couple of methods to generate a random number based on a probability density function. These methods involve transforming a uniform random number in some way. Because of this, these methods work equally well in generating both pseudorandom and true random numbers. One method, called the inversion method, involves integrating up to an area greater than or equal to the random number (which should be generated between 0 and 1 for proper distributions). A second method, called the acceptance-rejection method, involves choosing an x and y value and testing whether the function of x is greater than the y value. If it is, the x value is accepted. Otherwise, the x value is rejected and the algorithm tries again.^[12][13]

By humans

Random number generation may also be performed by humans, in the form of collecting various inputs from end users and using them as a randomization source. However, most studies find that human subjects have some degree of non-randomness when attempting to produce a random sequence of e.g. digits or letters. They may alternate too much between choices when compared to a good random generator;^[14] thus, this approach is not widely used.

Post-processing and statistical checks

See also: Randomness tests, Statistical randomness, and List of random number generators

Even given a source of plausible random numbers (perhaps from a quantum mechanically based hardware generator), obtaining numbers which are completely unbiased takes care. In addition, behavior of these generators often changes with temperature, power supply voltage, the age of the device, or other outside interference. And a software bug in a pseudorandom number routine, or a hardware bug in the hardware it runs on, may be similarly difficult to detect.

Generated random numbers are sometimes subjected to statistical tests before use to ensure that the underlying source is still working, and then post-processed to improve their statistical properties. An example would be the TRNG9803^[15] hardware random number generator, which uses an entropy measurement as a hardware test, and then post-processes the random sequence with a shift register stream cipher. It is generally hard to use statistical tests to validate the generated random numbers. Wang and Nicol^[16] proposed a distance-based statistical testing technique that is used to identify the weaknesses of several random generators. Li and Wang^[17] proposed a method of testing random numbers based on laser chaotic entropy sources using Brownian motion properties.

Other considerations

Random numbers uniformly distributed between 0 and 1 can be used to generate random numbers of any desired distribution by passing them through the inverse cumulative distribution function (CDF) of the desired distribution (see Inverse transform sampling). Inverse CDFs are also called quantile functions. To generate a pair of statistically independent standard normally distributed random numbers (x, y), one may first generate the polar coordinates (r, θ), where r²~χ22 and θ~UNIFORM(0,2π) (see Box–Muller transform).

Some 0 to 1 RNGs include 0 but exclude 1, while others include or exclude both.

The outputs of multiple independent RNGs can be combined (for example, using a bit-wise XOR operation) to provide a combined RNG at least as good as the best RNG used. This is referred to as software whitening.

Computational and hardware random number generators are sometimes combined to reflect the benefits of both kinds. Computational random number generators can typically generate pseudorandom numbers much faster than physical generators, while physical generators can generate "true randomness."

Low-discrepancy sequences as an alternative

Some computations making use of a random number generator can be summarized as the computation of a total or average value, such as the computation of integrals by the Monte Carlo method. For such problems, it may be possible to find a more accurate solution by the use of so-called low-discrepancy sequences, also called quasirandom numbers. Such sequences have a definite pattern that fills in gaps evenly, qualitatively speaking; a truly random sequence may, and usually does, leave larger gaps.

Activities and demonstrations

The following sites make available random number samples:

• The SOCR resource pages contain a number of hands-on interactive activities and demonstrations of random number generation using Java applets.
• The Quantum Optics Group at the ANU generates random numbers sourced from quantum vacuum. Sample of random numbers are available at their quantum random number generator research page.
• Random.org makes available random numbers that are sourced from the randomness of atmospheric noise.
• The Quantum Random Bit Generator Service at the Ruđer Bošković Institute harvests randomness from the quantum process of photonic emission in semiconductors. They supply a variety of ways of fetching the data, including libraries for several programming languages.
• The Group at the Taiyuan University of Technology generates random numbers sourced from a chaotic laser. Samples of random number are available at their Physical Random Number Generator Service.

Backdoors

Main article: Random number generator attack

Further information: Backdoor (computing)

Since much cryptography depends on a cryptographically secure random number generator for key and cryptographic nonce generation, if a random number generator can be made predictable, it can be used as backdoor by an attacker to break the encryption.

The NSA is reported to have inserted a backdoor into the NIST certified cryptographically secure pseudorandom number generator Dual EC DRBG. If for example an SSL connection is created using this random number generator, then according to Matthew Green it would allow NSA to determine the state of the random number generator, and thereby eventually be able to read all data sent over the SSL connection.^[18] Even though it was apparent that Dual_EC_DRBG was a very poor and possibly backdoored pseudorandom number generator long before the NSA backdoor was confirmed in 2013, it had seen significant usage in practice until 2013, for example by the prominent security company RSA Security.^[19] There have subsequently been accusations that RSA Security knowingly inserted a NSA backdoor into its products, possibly as part of the Bullrun program. RSA has denied knowingly inserting a backdoor into its products.^[20]

It has also been theorized that hardware RNGs could be secretly modified to have less entropy than stated, which would make encryption using the hardware RNG susceptible to attack. One such method which has been published works by modifying the dopant mask of the chip, which would be undetectable to optical reverse-engineering.^[21] For example, for random number generation in Linux, it is seen as unacceptable to use Intel's RDRAND hardware RNG without mixing in the RDRAND output with other sources of entropy to counteract any backdoors in the hardware RNG, especially after the revelation of the NSA Bullrun program.^[22][23]

In 2010, a U.S. lottery draw was rigged by the information security director of the Multi-State Lottery Association (MUSL), who surreptitiously installed backdoor malware on the MUSL's secure RNG computer during routine maintenance.^[24] During the hacks the man won a total amount of $16,500,000 by predicting the numbers correctly a few times in year.

Address space layout randomization (ASLR), a mitigation against rowhammer and related attacks on the physical hardware of memory chips has been found to be inadequate as of early 2017 by VUSec. The random number algorithm, if based on a shift register implemented in hardware, is predictable at sufficiently large values of p and can be reverse engineered with enough processing power (Brute Force Hack). This also indirectly means that malware using this method can run on both GPUs and CPUs if coded to do so, even using GPU to break ASLR on the CPU itself.^[25]

See also

• Flipism
• List of random number generators
• PP (complexity)
• Procedural generation
• Randomized algorithm
• Random password generator
• Random variable, contains a chance-dependent value

References

1. random(4) – Linux Programmer's Manual – Special Files
2. arc4random(3) – OpenBSD Library Functions Manual
3. Bird, Jordan J.; Ekárt, Anikó; Faria, Diego R. (2019-10-28). "On the effects of pseudorandom and quantum-random number generators in soft computing". Soft Computing. Springer Science and Business Media LLC. 24 (12): 9243–9256. doi:10.1007/s00500-019-04450-0. ISSN 1432-7643.
4. Li, Pu; Wang, Yun-Cai; Zhang, Jian-Zhong (2010-09-13). "All-optical fast random number generator". Optics Express. 18 (19): 20360–20369. Bibcode:2010OExpr..1820360L. doi:10.1364/OE.18.020360. ISSN 1094-4087. PMID 20940928.
5. Li, Pu; Sun, Yuanyuan; Liu, Xianglian; Yi, Xiaogang; Zhang, Jianguo; Guo, Xiaomin; Guo, Yanqiang; Wang, Yuncai (2016-07-15). "Fully photonics-based physical random bit generator". Optics Letters. 41 (14): 3347–3350. Bibcode:2016OptL...41.3347L. doi:10.1364/OL.41.003347. ISSN 1539-4794. PMID 27420532.
6. Wang, Anbang; Li, Pu; Zhang, Jianguo; Zhang, Jianzhong; Li, Lei; Wang, Yuncai (2013-08-26). "4.5 Gbps high-speed real-time physical random bit generator" (PDF). Optics Express. 21 (17): 20452–20462. Bibcode:2013OExpr..2120452W. doi:10.1364/OE.21.020452. ISSN 1094-4087. PMID 24105589. S2CID 10397141. Archived from the original (PDF) on 2020-10-24.
7. Walker, John. "HotBits: Genuine Random Numbers". Retrieved 2009-06-27.
8. Halprin, Ran; Naor, Moni. "Games for Extracting Randomness" (PDF). Department of Computer Science and Applied Mathematics, Weizmann Institute of Science. Retrieved 2009-06-27.
9. TrueCrypt Foundation. "TrueCrypt Beginner's Tutorial, Part 3". Retrieved 2009-06-27.
10. "RANDOM.ORG - True Random Number Service". www.random.org. Retrieved 2016-01-14.
11. "High Dimensionality Pseudo Random Number Generators". Retrieved 2018-11-21.
12. The MathWorks. "Common generation methods". Retrieved 2011-10-13.
13. The Numerical Algorithms Group. "G05 – Random Number Generators" (PDF). NAG Library Manual, Mark 23. Retrieved 2012-02-09.
14. W. A. Wagenaar (1972). "Generation of random sequences by human subjects: a critical survey of the literature". Psychological Bulletin. 77 (1): 65–72. CiteSeerX 10.1.1.211.9085. doi:10.1037/h0032060.
15. Dömstedt, B. (2009). "TRNG9803 True Random Number Generator". Manufacturer: www.TRNG98.se.
16. Wang, Yongge (2014). "Statistical Properties of Pseudo Random Sequences and Experiments with PHP and Debian OpenSSL". Computer Security - ESORICS 2014. Lecture Notes in Computer Science. 8712. Heidelberg: Springer LNCS. pp. 454–471. doi:10.1007/978-3-319-11203-9_26. ISBN 978-3-319-11202-2.
17. Li, Pu; Yi, Xiaogang; Liu, Xianglian; Wang, Yuncai; Wang, Yongge (2016-07-11). "Brownian motion properties of optoelectronic random bit generators based on laser chaos". Optics Express. 24 (14): 15822–15833. Bibcode:2016OExpr..2415822L. doi:10.1364/OE.24.015822. ISSN 1094-4087. PMID 27410852.
18. matthew Green (2013-09-18). "The Many Flaws of Dual_EC_DRBG".
19. Matthew Green (2013-09-20). "RSA warns developers not to use RSA products".
20. "We don't enable backdoors in our crypto products, RSA tells customers". Ars Technica. 2013-09-20.
21. "Researchers can slip an undetectable trojan into Intel's Ivy Bridge CPUs". Ars Technica. 2013-09-18.
22. Theodore Ts'o. "I am so glad I resisted pressure from Intel engineers to let /dev/random rely only on the RDRAND instruction". Google Plus.
23. Theodore Ts'o. "Re: [PATCH] /dev/random: Insufficient of entropy on many architectures". LWN.
24. Nestel, M.L. (July 7, 2015). "Inside the Biggest Lottery Scam Ever". The Daily Beast. Retrieved July 10, 2015.
25. "AnC - VUSec". Retrieved 13 July 2018.

Further reading

• Donald Knuth (1997). "Chapter 3 – Random Numbers". The Art of Computer Programming. Vol. 2: Seminumerical algorithms (3 ed.).
• L'Ecuyer, Pierre (2017). "History of Uniform Random Number Generation" (PDF). Proceedings of the 2017 Winter Simulation Conference. IEEE Press. pp. 202–230.
• L'Ecuyer, Pierre (2012). "Random Number Generation" (PDF). In J. E. Gentle; W. Haerdle; Y. Mori (eds.). Handbook of Computational Statistics: Concepts and Methods. Handbook of Computational Statistics (second ed.). Springer-Verlag. pp. 35–71. doi:10.1007/978-3-642-21551-3_3. hdl:10419/22195. ISBN 978-3-642-21550-6.
• Kroese, D. P.; Taimre, T.; Botev, Z.I. (2011). "Chapter 1 – Uniform Random Number Generation". Handbook of Monte Carlo Methods. New York: John Wiley & Sons. p. 772. ISBN 978-0-470-17793-8.
• Press, WH; Teukolsky, SA; Vetterling, WT; Flannery, BP (2007). "Chapter 7. Random Numbers". Numerical Recipes: The Art of Scientific Computing (3rd ed.). New York: Cambridge University Press. ISBN 978-0-521-88068-8.
• NIST SP800-90A, B, C series on random number generation
• M. Tomassini, M. Sipper, and M. Perrenoud (October 2000). "On the generation of high-quality random numbers by two-dimensional cellular automata". IEEE Transactions on Computers. 49 (10): 1146–1151. doi:10.1109/12.888056.

External links

• RANDOM.ORG True Random Number Service
• Random and Pseudorandom on In Our Time at the BBC
• jRand a Java-based framework for the generation of simulation sequences, including pseudorandom sequences of numbers
• Random number generators in NAG Fortran Library
• Randomness Beacon at NIST, broadcasting full-entropy bit-strings in blocks of 512 bits every 60 seconds. Designed to provide unpredictability, autonomy, and consistency.
• A system call for random numbers: getrandom(), a LWN.net article describing a dedicated Linux system call
• Statistical Properties of Pseudo Random Sequences and Experiments with PHP and Debian OpenSSL
• Cryptographic ISAAC pseudorandom lottery numbers generator
• Random Sequence Generator based on Avalanche Noise