Is Math.Random() truly random?

Ok Google! Roll a dice... You rolled 2, said Google. On what basis did it select this number?

I got this question when I used Math.random() for the first time i.e., asking a computer program to give me a number itself. Casinos, Lottery, gambling, and other places with immense money flow use random number generation, and it is a critical security element.

Photo by Steve Sawusch on Unsplash

If a machine generates random numbers by some external influence or an algorithm, it becomes biased to a particular choice, Right? Then can’t we do reverse-engineering and determine the so-called random number??

Let’s delve deeper.

“Randomness is a measure of uncertainty of an outcome. Random number generation means that the particular outcome sequence will contain some patterns detectable in hindsight but unpredictable to foresight” — Wikipedia

We roll dice to play an unbiased game. But in 2012, researchers from Poland predicted the outcome of a dice roll by using Chaos theory and high school mechanics!

They considered the initial conditions of the dice such as viscosity of the air, the acceleration of gravity and friction of the table, and created a 3D model. They observed that the face that was initially facing the table had a larger probability to be landed on it than the other faces. This suggests toss of dice is not a perfectly random action. So sometimes, unpredictable events become predictable.

Photo by Mike Szczepanski on Unsplash

Middle-square method

The middle-square method was invented by John von Neumann. This method is the pioneer for Random Number Generation (RNG) algorithms. Let’s take a look at this algorithm.

1. Take a truly random number (highly non-deterministic). For example, it may be the milliseconds in the current time (132). This number is the seed value. Other sources are atmospheric noise, thermal noise, cosmic background radiation, or any random fluctuations.
2. Square it (132² =17424) and take the middle digits(742).
3. Repeat step-2, where the output becomes the new seed. [742² = 0550564, 505² = 0255025, 550² = 0302500, 025² = 00625, 062² = 03844,… ]

Random number sequence = {132, 742, 550, 025, 062, 384,…}

The randomness of the number generated is dependent on the seed value’s randomness. We get the same sequence for the same seed. Importantly, this sequence repeats after a particular point and also misses many of the numbers. But this satisfied his need at that time. Today, the world has got a lot of RNGs.

“Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin.” — John von Neumann

RNG by humans

Humans’ choices are deterministic and biased to their previous thoughts. Studies say humans have some degree of non-randomness. So, RNG by humans is not suitable.

Computer-generated random numbers/Psuedo random numbers

Computer-generated random numbers are generally determined by the seed. Seeds have to be secretive. We have seen before that an algorithm uses seeds to produce random numbers. Seeds are sometimes obtained from end-user activities such as mouse movements, keyboard activities, etc.

Photo by Louis Hansel on Unsplash

In cryptography, to generate keys, nonce, salts, random numbers are used. The entropy of the random number produced is very much crucial. So, pseudo RNGs have to be carefully selected.

The RNG in many of the programming languages is based on the Mersenne Twister algorithm. It has a period of 2¹⁹⁹³⁷ -1, which is very long. But still, this algorithm is not sufficient for cryptographical purposes and other needs which require higher entropy.

Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security — MDN

RANDOM.ORG uses atmospheric noise as their seed value to generate random numbers. People use it for lotteries, online games, sweepstakes, etc.

Physical RNGs

HotBits produces genuine random numbers by using the time between successive pairs of radioactive decays which are uncertain and are interfaced to a computer.

Source: ggo.org

Hardware random number generators are considered to be true random number generators. These generations are from physical processes and quantum phenomena. They are completely unpredictable as long as the equations governing them are unknown.

Generally, hardware RNGs convert random physical fluctuations into digital numbers and these random fluctuations are read again and again to generate a sequence of random numbers.

Hardware RNGs play an important role in cryptographic systems. But still, there are potential attacks that can rig the output, mostly side-channel attacks i.e., based on the timing information, power consumption, EM leaks, etc.

If the random number generated is predictable, the encryption becomes vulnerable.

Attacks and backdoors

• Microsoft Windows 2000/XP random number generator — Deterministic
• Hardware RNG attacks
• Hot Lotto fraud scandal — Lottery-rigging scandal ($16,500,000)
• PlayStation3 hack — Sony failed to generate a random nonce

References

• Wikipedia — Random_number_generation
• Wikipedia — Random_number_generator_attack
• Youtube — Pseudorandom Number Generators
• Youtube — How Chaos Theory Unravels the Mysteries of Nature

Further reading

• Quantum RNG — https://www.idquantique.com/random-number-generation/overview/
• Random number generators — https://en.wikipedia.org/wiki/List_of_random_number_generators
• Cryptographically secure pseudo RNGs — https://en.wikipedia.org/wiki/Cryptographically-secure_pseudorandom_number_generator
• Chaos theory — https://en.wikipedia.org/wiki/Chaos_theory

This article is published under Spider Research and Development Club, NIT Trichy on a Web Wednesday!