Lecture 14 Chapter 02 section 2.5 Random and Pseudorandom Numbers

Lecture on random and pseudorandom numbers in cryptography: why randomness matters, statistical properties, applications like RSA, session keys, nonces, and true vs. pseudo-random generation.

Key Takeaways

Randomness in cryptography must be statistically uniform and independent, and above all unpredictable to attackers.
Random numbers underpin RSA, session keys, stream ciphers, nonces, and replay protection.
True random numbers come from physical sources; pseudo-random numbers come from deterministic algorithms seeded with secret values.
Randomized algorithms make expensive problems such as prime verification practical.

What the video covers

Introduces section 2.5 of Cryptographic Tools: random and pseudorandom numbers.
Random numbers are primarily used in cryptographic and network security algorithms to keep keys unpredictable to attackers.
Statistical randomness requires uniform distribution (every value equally likely) and independence (no value can be inferred from previous ones).
Unpredictability is often more important in security than perfect statistical uniformity.
Applications include RSA key generation (finding large primes), stream ciphers, session keys in digital envelopes, Kerberos, and key distribution in Diffie-Hellman.
Randomized primality testing makes checking very large numbers for primality computationally practical with high confidence.
Nonces in blockchain and handshakes help prevent replay attacks and protect data integrity.
Two main categories: true random numbers (generated from physical, non-deterministic sources such as radiation or mouse movement) and pseudo-random numbers (generated by deterministic algorithms from a seed).
Pseudo-random generators must use cryptographic features so that the output pattern cannot be discovered by an attacker.
Reproducing the same seed reproduces the same sequence, which is why the seed must be kept secret.

Chapters

Why does cryptography need random numbers?

Random numbers make keys and session values unpredictable to attackers, which is essential for securing encryption, RSA key generation, and session keys. Without them, an attacker could potentially derive the keys.

What two conditions must a sequence satisfy to be considered statistically random?

The sequence must have a uniform distribution, meaning every possible value has equal probability, and it must be independent, meaning no value can be predicted from previous ones.

What is the difference between true random and pseudo-random numbers?

True random numbers come from physical, non-deterministic processes such as radiation events. Pseudo-random numbers are produced by deterministic algorithms from a seed, so they appear random but follow a pattern that must be kept hidden from attackers.

Full Transcript — Download SRT & Markdown

Speaker A

Welcome to a new lecture from the second chapter, Cryptographic Tools. We will talk about section 2.5: Random and Pseudorandom Numbers. Right, what is randomness? Randomness refers to random numbers. What is the use of random numbers? It tells us that we use random

Speaker A

numbers primarily in cryptographic and network security algorithms. Why? Because they make the behavior or the key used in the encryption process unpredictable to whom? To the next person, or the person who might sniff our network. So, randomness implies

Speaker A

statistical uniformity and unbiasedness . Okay, so what is randomness? It consists of values that follow a specific distribution or statistical properties. Such that they are uniform, distributed equally. Meaning, 5 should appear as often as 4, or 20, or 30; not

Speaker A

5 appearing 20 times while 4 appears once, for example. And the second thing , what does it tell us? Independent.

Speaker A

What does independent mean? The current value, okay, has no relationship with the previous value or the subsequent value. Another thing it tells us is what? Unpredictability. That since it is independent, it means it will be difficult to predict for the attacker.

Speaker A

They won't be able to perform future calculations, won't be able to predict future values from previous ones. Okay, what applications do we have for random numbers? Applications for random numbers include RSA key generation. RSA , we said, is a public key, we have

Speaker A

public-key encryption with public and private keys, which relies primarily on what? Large prime numbers. Right. I need to generate large prime numbers.

Speaker A

If I have a number like 10 to the power of 150, how do I know? Whether this number is prime or not. Should I divide by all smaller values? Well, I can't divide it by 10 to the power of 150

Speaker A

values. No. So we use some random algorithms to solve this problem. Stream ciphers. What are stream ciphers ? Remember, I have blocks that I want to encrypt. I encrypt the first one with a key and send it. And the second

Speaker A

with a different key and send it. And the third, the fourth, and the fifth. I generated a stream of keys such that the key cannot be predicted or derived from a previous one. Everything uses randomness. Also session keys, as we

Speaker A

saw in the digital envelope. I want to send a message, so I encrypt the message with a key and send the message with its encrypted key. Thus, it creates temporary session keys.

Speaker A

Kerberos, which is to prevent what? This is a technique we were supposed to explain in chapter 23, but we won't explain it. However, it is a technique built on preventing replay attacks.

Speaker A

Right. What are replay attacks? It's where I resend the same message again during the handshake. This causes confusion for the recipient or the sender. Consequently, it creates a problem. The last thing we have is key distribution. Now I specifically need

Speaker A

key distribution, for example, as we said in Diffie-Hellman. If I were able to know or predict how they generated the random numbers they use to build the keys. Then I could know the key because P and G were known. Nice. So if

Speaker A

I can, I use random numbers in this case, so that no one can predict the key that the pool generates or the key that I generated. Right. Okay, so the fundamental idea of random numbers is that all encryption systems need

Speaker A

numbers. And these numbers must be difficult for an attacker to predict. Right. Okay, randomness is built on two basic principles or two essential properties. Right. Any sequence can be considered random if. It is statistically random, meaning it must

Speaker A

satisfy two conditions: the first is uniform distribution, and the second is independence. What does uniform distribution mean? Every possible value must have an equal probability of appearing. Right, which is the same as.

Speaker A

The rest of the values having an approximately equal frequency. What does independence mean? No value can be inferred. What does inferred mean? It means I cannot predict a subsequent value from a previous value. What do you mean? I have 7, 9, 4. Can I predict

Speaker A

the next value? No. What about 7? 2, 9, I can't predict the next value. Right.

Speaker A

But if I take a number. Here is 5, for example, 5, 7, 9. 11; I have a sequence 5, 7, each one increases by 2, so I can predict the next one is 13. Right. In this case, it didn't satisfy the

Speaker A

independence condition. Therefore, no value can be inferred from the others in the sequence. I must not be able to predict a subsequent value from a previous one. If it satisfies these two conditions, then I say my sequence is

Speaker A

random. If it satisfies both conditions , then the sequence is random. Is that clear? I can use some statistical tests to discover if my sequence is random or not. Right. But even if I discover it is not random, it's possible. Right.

Speaker A

It's possible that I cannot definitively prove it is independent. Okay, randomness in cryptography, it says randomness can make a difficult problem practical. For example, RSA prime generation. I told you about RSA, if I want to generate a 10 ^ 150 prime

Speaker A

number—we said our keys must be large . Now, how do I prove that this key is prime? I have to take the square root of 10 ^ 150 for all numbers below the value resulting from here. Let's assume

Speaker A

it came out to be, for instance, 10 ^ 75; all numbers below this, I have to go and check. Does it divide by them or not? In case the number divides by one of them, it's not a prime number. So I

Speaker A

want to divide. Perform the division or modulo operation, repeating it 10 ^ 75 times; the division process here would be extremely large. Therefore, to arrive at whether this is random or not is a very difficult and costly process.

Speaker A

It tells me, what is the solution? The solution, quite simply, is that I need to use some algorithms. What does Randomness Primality do? It takes random numbers in a specific way, such that I divide by these random numbers.

Speaker A

If my number that I generated for the first time escapes the random primality , I will consider it random. I will consider it what? Random. Consequently, it will give me very high confidence.

Speaker A

And it will give me what? Simpler computation, is that clear? Because it is unpredictable. It tells me that in some security applications, the unpredictability of the next number is much more important to me than saying that the 5, 4, 50, and 100 must. Appear

Speaker A

equally in the process. Meaning, I might have the 5 appear twice, five times, while the 4 appears once, for example. Right? But what matters most to me is that it shouldn't be predictable. Like how? Like for instance, authentication. If we do a

Speaker A

handshake between the sender and receiver as you took in networks, we will use the fact that unpredictability is more important to me than 100% randomness. Session key generation. If I am establishing a connection in a network, as we said in. Digital

Speaker A

envelopes, right? Session key generation, no one can predict it. This is an excellent thing. Nonces are numbers used to start the process in blockchains, right? So if I want to build a block in the blockchain, I must have a nonce. So the point that I

Speaker A

cannot predict the nonce. This means I am able to build a block that no one else can do. Which is, to be able to create a block like that. Replay attack protections, what does that mean? This also relates to the handshake, meaning

Speaker A

I. Cannot, or not the handshake. It relates to the handshake and relates to other things. That I prevent any user from sending the same message twice, or any attacker from resending the same message twice. So that it doesn't cause

Speaker A

confusion in the data received. Consequently, I have a problem. And in this case, it hits, what? Data integrity. It hit the data integrity, are things clear? 100%. How will I know that I want to write? I will sit and

Speaker A

monitor the incoming values, meaning X1 , X2, X3, X4. If I generated these four values and couldn't predict the value that comes after them. That means I was able to predict what? Unpredictability, the problem, you tell me. We mentioned

Speaker A

it. Right. What kind of randomness do we have? In randomness, we have two types. We have true random numbers, and we have seed. And we have something called pseudo-random numbers. True random numbers are truly random numbers . They are generated from physical

Speaker A

processes with unpredictable values, right? What does it tell me? Generated from non-deterministic physical processes. There is no governing process for it, there is not. It has a governing equation. What kind of physical process do we have? Can. For

Speaker A

example, that I. The value, the values I have, I cannot predict them. From what? From another algorithm, right?

Speaker A

For example, thermal noise, radiation events, and electronic noise, okay? This is electron movement, which is the noise resulting from heat or radioactive values. The second type of random is pseudo-random numbers; this one says I generate it using a clear

Speaker A

algorithm. For statistical generation, to people, it will appear random. But in reality, it follows a specific pattern. The idea is that I don't want the attacker to be able to know this pattern. It says if I use the same

Speaker A

algorithm with the same initial...... initial state, let's call it the same seed number. It will give me, in the end, the same sequence. True random, no , it doesn't give me the same sequence.

Speaker A

Okay. But pseudo-random, if I used the same algorithm with the same initial state, I will inevitably get what? The same sequence. So here, in this case, I want to try to have my initial state depend on something random. Like, for

Speaker A

example, device time, like...Or depend on something from random numbers. Like noise generation. Like electronic noise . I mean, in pseudo-random numbers, we use what? We do this, we tell the user: Before I generate your random number for the key, what should you do? Keep

Speaker A

moving the mouse randomly on the screen . A movement like this. Like this, like this. Like this. Keep moving it like this. So I read the mouse position.

Speaker A

Because the mouse position is random. Your hand movement is like mine, like others '. And therefore, I can generate a strong random number. It is clear why your hand movement on the screen is random. There is nothing to study there

Speaker A

. Okay. I tell you to keep moving your hand. Move your hand on the screen with the mouse. Or move the mouse on the screen. I will take a random movement.

Speaker A

I will generate an unpredictable random number for you. Consequently, it moves slightly out of the pseudo-random number. And becomes closer to what?

Speaker A

True random numbers. Okay, what is the difference between the two? True random number is physical, non-deterministic.

Speaker A

There is no process controlling it. There is no algorithm. There is no equation that governs it. Pseudo-random , no, this is algorithmic. It has a process and is deterministic. True random number is non-deterministic and ...While the pseudo-random number is

Speaker A

deterministic. The speed is usually slower, why? Because I need to control the process first, I need to monitor the physical process, then based on it, I generate the number, while this one is higher, why? Faster. We have an

Speaker A

algorithm, apply it and go. It says no, in both cases, with true random numbers , it is impossible to reproduce. Okay.

Speaker A

While in pseudo-random numbers, if I use the same, I have actually reproduced it. Used. However. In the pseudo-random number, we will have what is...We might have some security notes on the subject. Cryptographic features to avoid being predictable. We said how

Speaker A

we will do this move, like telling you the seed, don't take a value from me, don't let the algorithm be the one that generates the seed. I, for the seed, tell him, for example, move the mouse on the screen randomly. While you are

Speaker A

moving the mouse on the screen randomly , what do I do? I generate the pseudo-random number. I take it as a seed. That is okay. So, I just moved the mouse. It's a shape. It's a shape.

Speaker A

It's a shape. It's a shape. Okay. Every time I move it randomly. Like this.

Speaker A

That way, I make it harder for the attacker. Now, how do I do true random number generation? How do I generate them? It tells me to monitor natural events like ionizing radiation events, right? Radiation resulting from ions or

Speaker A

gas discharge. Thermal noise, physical noise features, right? The basic principle is that I have a physical phenomenon. I want to monitor it and take its measurements, its statistics.

Speaker A

Consequently, I will generate a random number. And I will use it to seed a cryptographic pseudo-random generator.

Speaker A

In this case, what did I gain? I have two-in-one generated. A strong and unpredictable pseudo-random number. And its seed is different every time. Right . The random number I use as an initial seed. An initial seed, which is the

Speaker A

starting point. Right. What did we say here? We talked about how cryptography relies primarily on the value number.

Speaker A

The value number relies on the seed, on the random number. Oh, I mean randomness. Randomness focuses primarily on statistical properties.

Speaker A

Which is unpredictability. It focuses on my numbers being unpredictable. What does that mean? The previous number cannot be predicted in any way from the previous ones. True random numbers rely on physical sources. Which are physical phenomena. Pseudo-random numbers rely

Speaker A

on deterministic ones. Which are clear algorithms. True random numbers, okay. The output can be used as a seed for physical pseudo-random. Thank you very much.

Topics:random numberspseudorandom numberscryptographyRSAsession keysnoncereplay attacktrue random number generatorstream ciphernetwork security

Get More with the SozAI App

Transcribe recordings, audio files, and YouTube videos — with AI summaries and speaker detection. 30 minutes free.

App Store Google Play

Or transcribe another YouTube video here →

Free tools: TXT to SRT · SRT Validator · Merge SRT · Subtitle to Text · All tools