A pseudorandom generator is a function G : {0,1}n → {0,1}ℓ with ℓ > n: it stretches a short secret seed into a long stream.
It is secure if no efficient test tells G(s) for a uniform seed s apart from ℓ fair coin flips, better than guessing.
You are that test. Set the parameters, then try to beat 50%.
Everything the generator gets is set here. The seed length is the only secret the machine holds, so it is also the thing that decides whether brute force beats you.
Metronome settings
Round 1 of 12
Your score against the Metronome
advantage = |2·(fraction right) − 1|. Guessing blindly gives 0.
Tests you can run on this sample
Pick any one; parameters follow your selection. Get the break threshold and you have found a distinguisher. The first five are candidate generators that fail — each survives the attack that killed the one before it.
A generator holds no randomness of its own: the same seed always gives the same stream, so every bit of unpredictability comes from the seed you keep secret. Change one bit of it and watch what moves.
The distinguisher that always exists. Compute G(s) for every seed s ∈ {0,1}n, keep the results in a table, then answer machine exactly when the challenge string appears in it. It never loses against the generator, no matter which generator you point it at. Its only weakness is the bill: 2n evaluations to build, and 2n·ℓ bits to hold.
What this same table would cost at other seed lengths, at the speed just measured on your machine
With n = 4 there are only sixteen seeds, so the whole table fits on one screen. Step through the seeds one at a time and the generator computes each stream for you — nobody evaluates SHA-256 in their head. Your job is the part that matters: count what came out, and work out how often a random string lands in the table.
Three questions about the distinguisher you just built. Answer each from the definition first, then measure it and see whether the page agrees with you.
The stream cipher on the left, your browser's cryptographic randomness on the right, with every test run against both. This is what indistinguishability looks like in practice: two columns you cannot tell apart, one of which is fully determined by four to thirty-two bits.
| test | stream cipher | fair coins |
|---|