White-Box PRNG: A Secure Pseudo-Random Number Generator under the White-Box Attack Model

The random number generator (RNG) plays a crucial role in modern cryptography. While true RNG (TRNG) is available, pseudo RNG (PRNG) is often preferred due to its better compatibility. However, PRNGs have long been vulnerable to the leakage of internal states, which compromises their properties of resilience, forward security, and backward security. Furthermore, this threat will become more prevalent as adversaries gain full control of the PRNG. Inspired by white-box cryptography, we aim to provide a definition of white-box PRNG that protects against the leakage of internal states. Additionally, we bind the white-box PRNG with a specific application to resist code-lifting attacks. We implement the white-box PRNG based on various types of white-box SM4 ciphers and measure their storage overhead and random number generation speed. Meanwhile, we evaluate the randomness of the generated numbers using randomness test standards, including NIST SP 800-90B and GM/T 0005–2021, and compare the testing results to the output of Linux entropy pool and OpenSSL.