MODEL OF AN INCIDENT RESPONSE PLAN FOR INCIDENTS RELATED TO THE USE OF WEAK PSEUDORANDOM NUMBER GENERATORS
MODEL OF AN INCIDENT RESPONSE PLAN FOR INCIDENTS RELATED TO THE USE OF WEAK PSEUDORANDOM NUMBER GENERATORS
D. Buhai,Ihor Vlasiuk,V. Susukailo,Y. Kurii
TLDR
The article analyzes pseudorandom number generators in cryptography, considers their theoretical foundations, classification, and basic security requirements, and proposes a universal response plan for incidents involving vulnerabilities in pseudorandom number generators and an algorithm for automating responses to such incidents.
Abstract
The article analyzes pseudorandom number generators (PRNGs) in cryptography, considers their theoretical foundations, classification, and basic security requirements. In particular, it considers how deterministic algorithms based on the initial seed generate long sequences of bits that are practically indistinguishable from truly random ones, therefore, different types of generators were analyzed: from simple linear congruent generators (LCGs) and Mersenne Twister, which are well suited for modeling and numerical calculations, to cryptographically stable algorithms ChaCha20 and Yarrow, which provide unpredictability and resistance to predicting the initial sequence. A universal response plan for incidents involving vulnerabilities in pseudorandom number generators and an algorithm for automating responses to such incidents are proposed. The results of the study can be used by developers of cryptographic algorithms and information security specialists to improve the assessment of pseudorandom number generator choices for practical and educational purposes.