In this work, we present CoolTest, a randomness test well-suited for scenarios with only small volumes of data. CoolTest searches for a correlation among any k bits within a fixed-size window. CoolTest generalizes BoolTest (ICETE’17) and builds on the innovative idea of Chatterjee et al. (INDOCRYPT’22), making it practical. Using this idea, CoolTest identifies the strongest correlation on k bits by evaluating only 2 k candidates instead of all 2 2 k Boolean functions. CoolTest finds arbitrary k -bit correlations with complexity comparable to BoolTest and the method of Chatterjee et al., evaluating 100 MB of data in tens of seconds, while those approaches are limited to predefined or nearby-bit correlations. We evaluated CoolTest on outputs of 14 reduced-round cryptographic functions (e.g., AES, Twofish, Keccak, and MD5). CoolTest performs at least as well as BoolTest in 26 out of 28 cases and often finds stronger correlations. On 100 MB of data, CoolTest detects bias in a higher number of rounds of SHA-2, SHA-1, MD6, and SHACAL-2 than the commonly used test suites NIST STS, Dieharder, and TestU01. We estimate the minimal amount of data required to detect correlations depending on the type and relative frequency of the underlying non-random pattern, and show how increasing data size improves the statistical significance of the detected correlations.

The output of cryptographic functions, be it encryption routines or hash functions, should be statistically indistinguishable from a truly random data for an external observer. The property can be partially tested automatically using batteries of statistical tests. However, it is not easy in practice: multiple incompatible test suites exist, with possibly overlapping and correlated tests, making the statistically robust interpretation of results difficult. Additionally, a significant amount of data processing is required to test every separate cryptographic function. Due to these obstacles, no large-scale systematic analysis of the the round-reduced cryptographic functions w.r.t their input mixing capability, which would provide an insight into the behaviour of the whole classes of functions rather than few selected ones, was yet published. We created a framework to consistently run 414 statistical tests and their variants from the commonly used statistical testing batteries (NIST ST S, Dieharder, TestU01, and BoolTest). Using the distributed computational cluster providing required significant processing power, we analyzed the output of 109 round-reduced cryptographic functions (hash, lightweight, and block-based encryption functions) in the multiple configurations, scrutinizing the mixing property of each one. As a result, we established the fraction of a function’s rounds with still detectable bias (a.k.a. security margin) when analyzed by randomness statistical tests.

Randomness testing is an important procedure that bit streams, produced by critical cryptographic primitives such as encryption functions and hash functions, have to undergo. In this paper, a new hardware platform for the randomness testing is proposed. The platform exploits the principles of genetic programming, which is a machine learning technique developed for the automated program and circuit design. The platform is capable of evolving efficient randomness distinguishers directly on a chip. Each distinguisher is represented as a Boolean polynomial in the algebraic normal form. The randomness testing is conducted for bit streams that are either stored in an on-chip memory or generated by a circuit placed on the chip. The platform is developed with a Xilinx Zynq-7000 All Programmable System on Chip that integrates a field programmable gate array with on-chip ARM processors. The platform is evaluated in terms of the quality of randomness testing, performance, and resources utilization. With power budget less than 3 W, the platform provides comparable randomness testing capabilities with the standard testing batteries running on a personal computer.

The security of cryptographic algorithms (such as block ciphers and hash functions) is often evaluated in terms of their output randomness. This paper presents a novel method for the statistical randomness testing of cryptographic primitives, which is based on the evolutionary construction of the so-called randomness distinguisher. Each distinguisher is represented as a Boolean polynomial in the Algebraic Normal Form. The previous approach, in which the distinguishers were developed in two phases by means of the brute-force method, is replaced with a more scalable evolutionary algorithm (EA). On seven complex datasets, this EA provided distinguishers of the same quality as the previous approach, but the execution time was in practice reduced 40 times. This approach allowed us to perform a more efficient search in the space of Boolean distinguishers and to obtain more complex high-quality distinguishers than the previous approach.

We report on our discovery of an algorithmic flaw in the construction of primes for RSA key generation in a widely-used library of a major manufacturer of cryptographic hardware. The primes generated by the library suffer from a significant loss of entropy. We propose a practical factorization method for various key lengths including 1024 and 2048 bits. Our method requires no additional information except for the value of the public modulus and does not depend on a weak or a faulty random number generator. We devised an extension of Coppersmith's factorization attack utilizing an alternative form of the primes in question. The library in question is found in NIST FIPS 140-2 and CC~EAL~5+ certified devices used for a wide range of real-world applications, including identity cards, passports, Trusted Platform Modules, PGP and tokens for authentication or software signing. As the relevant library code was introduced in 2012 at the latest (and probably earlier), the impacted devices are now widespread. Tens of thousands of such keys were directly identified, many with significant impacts, especially for electronic identity documents, software signing, Trusted Computing and PGP. We estimate the number of affected devices to be in the order of at least tens of millions.

The wide range of security applications requires data either truly random or indistinguishable from the random. The statistical tests included in batteries like NIST STS or Dieharder are frequently used to assess this randomness property. We designed principally simple, yet powerful statistical randomness test working on the bit level and based on a search for boolean function(s) exhibiting bias not expected for truly random data when applied to the tested stream. The deviances are detected in seconds rather than tens of minutes required by the common batteries. Importantly, the boolean function exhibiting the bias directly describes the pattern responsible for this bias - allowing for construction of bit predictor or fixing the cause of bias in tested function design. The present bias is frequently detected in at least order of magnitude less data than required for NIST STS or Dieharder showing that the tests included in these batteries are either too simple to spot the common biases (like Monobit test) or overly complex (like Fourier Transform test) which requires an extensive amount of data. The proposed approach called BoolTest fills this gap. The performance was verified on more than 20 real world cryptographic functions – block and stream ciphers, hash functions and pseudorandom generators. Among others, the previously unknown bias in output of C rand() and Java Random generators which can be utilized as practical distinguisher was found.

The NIST Statistical Test Suite (NIST STS) is one of the most popular tools for the analysis of randomness. This test battery is widely used, but its implementation is quite inefficient. A complete randomness analysis using the NIST STS can take hours on a standard computer when the tested data volume is on the order of GB. We improved the most time-consuming test (Linear Complexity) from the previous most efficient implementation of the NIST STS. We also optimized other tests and achieved an overall speedup of 50.6 × compared with the reference implementation. This means that 20MB of data can be tested within a minute using our new optimized version of the NIST STS. To speed up the Linear Complexity test, we proposed a new version of the Berlekamp-Massey algorithm that computes only the linear complexity of a sequence. This new variant does not construct a linear feedback shift register and is approximately 187 × faster than the original NIST implementation of the Berlekamp-Massey algorithm.

In this paper we introduce a general framework for automatic construction of empirical tests of randomness. Our new framework generalises and improves a previous approach (Svenda et al., 2013) and it also provides a clear statistical interpretation of its results. This new approach was tested on selected stream ciphers from the eSTREAM competition. Results show that our approach can lay foundations to randomness testing and it is comparable to the Statistical Test Suite developed by NIST. Additionally, the proposed approach is able to perform randomness analysis even when presented with sequences shorter by several orders of magnitude than required by the NIST suite. Although the Dieharder battery still provides a slightly better randomness analysis, our framework is able to detect non-randomness for stream ciphers with limited number of rounds (Hermes, Fubuki) where both above-mentioned batteries fail.