Practrand is a bad tester of random number generator on large data sets.The more data there is to test, the less it detects things.
Here is the test i did.
I created a 8GB file with all 0x00:
8 GB
8 589 934 592 bytes
I encrypted this file with AES 128 and a random key.
I encrypted this result file with AES 128 and an other key. I named this file :
file1.Tests with this file:Quote:
type file1 | RNG_test.exe stdin8
Quote:
RNG_test using PractRand version 0.94
RNG = RNG_stdin8, seed = unknown
test set = core, folding = standard (8 bit)
rng=RNG_stdin8, seed=unknown
length= 32 megabytes (2^25 bytes), time= 2.3 seconds
no anomalies in 93 test result(s)
rng=RNG_stdin8, seed=unknown
length= 64 megabytes (2^26 bytes), time= 5.4 seconds
no anomalies in 99 test result(s)
rng=RNG_stdin8, seed=unknown
length= 128 megabytes (2^27 bytes), time= 10.4 seconds
no anomalies in 108 test result(s)
rng=RNG_stdin8, seed=unknown
length= 256 megabytes (2^28 bytes), time= 17.8 seconds
Test Name Raw Processed Evaluation
[Low1/8]Gap-16:B R= -4.1 p =1-1.8e-3 unusual
...and 117 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 512 megabytes (2^29 bytes), time= 33.4 seconds
Test Name Raw Processed Evaluation
[Low1/8]DC6-9x1Bytes-1 R= -4.3 p =1-3.8e-3 unusual
...and 125 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 1 gigabyte (2^30 bytes), time= 62.9 seconds
no anomalies in 135 test result(s)
rng=RNG_stdin8, seed=unknown
length= 2 gigabytes (2^31 bytes), time= 123 seconds
no anomalies in 144 test result(s)
rng=RNG_stdin8, seed=unknown
length= 4 gigabytes (2^32 bytes), time= 234 seconds
no anomalies in 151 test result(s)
Quote:
type file1 | rng_test stdin8 -te 1 -tlmin 10 -tlmax 50 -tlmaxonly
Quote:
RNG_test using PractRand version 0.94
RNG = RNG_stdin8, seed = unknown
test set = expanded, folding = standard (8 bit)
rng=RNG_stdin8, seed=unknown
length= 1 kilobyte (2^10 bytes), time= 0.3 seconds
Test Name Raw Processed Evaluation
FPF-14+6/64:all R= +13.2 p~= 1e-3 unusual
...and 15 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 2 kilobytes (2^11 bytes), time= 1.1 seconds
Test Name Raw Processed Evaluation
DC6-9x1Bytes-1 R= +6.0 p = 0.013 unusual
...and 20 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 4 kilobytes (2^12 bytes), time= 2.0 seconds
no anomalies in 29 test result(s)
rng=RNG_stdin8, seed=unknown
length= 8 kilobytes (2^13 bytes), time= 3.0 seconds
no anomalies in 52 test result(s)
rng=RNG_stdin8, seed=unknown
length= 16 kilobytes (2^14 bytes), time= 4.7 seconds
no anomalies in 62 test result(s)
rng=RNG_stdin8, seed=unknown
length= 32 kilobytes (2^15 bytes), time= 6.4 seconds
no anomalies in 76 test result(s)
rng=RNG_stdin8, seed=unknown
length= 64 kilobytes (2^16 bytes), time= 8.2 seconds
no anomalies in 91 test result(s)
rng=RNG_stdin8, seed=unknown
length= 128 kilobytes (2^17 bytes), time= 10.0 seconds
Test Name Raw Processed Evaluation
DC6-9x1Bytes-1 R= -4.7 p =1-5.0e-3 unusual
...and 101 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 256 kilobytes (2^18 bytes), time= 11.8 seconds
Test Name Raw Processed Evaluation
[Low1/8]FPF-14+6/16:all R= +6.7 p = 2.8e-4 unusual
...and 114 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 512 kilobytes (2^19 bytes), time= 13.7 seconds
no anomalies in 129 test result(s)
rng=RNG_stdin8, seed=unknown
length= 1 megabyte (2^20 bytes), time= 15.5 seconds
no anomalies in 142 test result(s)
rng=RNG_stdin8, seed=unknown
length= 2 megabytes (2^21 bytes), time= 17.5 seconds
Test Name Raw Processed Evaluation
[Low1/8]BCFN(0+1,13-8,T) R= +12.3 p = 4.6e-4 unusual
...and 155 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 4 megabytes (2^22 bytes), time= 19.6 seconds
no anomalies in 169 test result(s)
rng=RNG_stdin8, seed=unknown
length= 8 megabytes (2^23 bytes), time= 22.0 seconds
no anomalies in 183 test result(s)
rng=RNG_stdin8, seed=unknown
length= 16 megabytes (2^24 bytes), time= 25.0 seconds
no anomalies in 198 test result(s)
rng=RNG_stdin8, seed=unknown
length= 32 megabytes (2^25 bytes), time= 29.0 seconds
no anomalies in 212 test result(s)
rng=RNG_stdin8, seed=unknown
length= 64 megabytes (2^26 bytes), time= 34.8 seconds
no anomalies in 225 test result(s)
rng=RNG_stdin8, seed=unknown
length= 128 megabytes (2^27 bytes), time= 44.0 seconds
Test Name Raw Processed Evaluation
[Low1/8]DC6-6x2Bytes-1 R= +5.6 p = 2.0e-3 unusual
...and 239 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 256 megabytes (2^28 bytes), time= 61.5 seconds
no anomalies in 254 test result(s)
rng=RNG_stdin8, seed=unknown
length= 512 megabytes (2^29 bytes), time= 93.1 seconds
Test Name Raw Processed Evaluation
[Low1/8]DC6-9x1Bytes-1 R= -4.3 p =1-3.8e-3 unusual
...and 267 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 1 gigabyte (2^30 bytes), time= 158 seconds
no anomalies in 287 test result(s)
rng=RNG_stdin8, seed=unknown
length= 2 gigabytes (2^31 bytes), time= 281 seconds
no anomalies in 304 test result(s)
rng=RNG_stdin8, seed=unknown
length= 4 gigabytes (2^32 bytes), time= 516 seconds
no anomalies in 318 test result(s)
Then i modified file1At offset 0x3BA5BB24 i replaced 10 bytes with 0x00 :00 00 00 00 00 00 00 00 00 00
and i did the test again and the 10 zero bytes are not detected :Quote:
type file1 | RNG_test.exe stdin8
Quote:
RNG_test using PractRand version 0.94
RNG = RNG_stdin8, seed = unknown
test set = core, folding = standard (8 bit)
rng=RNG_stdin8, seed=unknown
length= 32 megabytes (2^25 bytes), time= 2.2 seconds
no anomalies in 93 test result(s)
rng=RNG_stdin8, seed=unknown
length= 64 megabytes (2^26 bytes), time= 4.4 seconds
no anomalies in 99 test result(s)
rng=RNG_stdin8, seed=unknown
length= 128 megabytes (2^27 bytes), time= 8.6 seconds
no anomalies in 108 test result(s)
rng=RNG_stdin8, seed=unknown
length= 256 megabytes (2^28 bytes), time= 17.0 seconds
Test Name Raw Processed Evaluation
[Low1/8]Gap-16:B R= -4.1 p =1-1.8e-3 unusual
...and 117 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 512 megabytes (2^29 bytes), time= 31.9 seconds
Test Name Raw Processed Evaluation
[Low1/8]DC6-9x1Bytes-1 R= -4.3 p =1-3.8e-3 unusual
...and 125 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 1 gigabyte (2^30 bytes), time= 58.6 seconds
no anomalies in 135 test result(s)
rng=RNG_stdin8, seed=unknown
length= 2 gigabytes (2^31 bytes), time= 116 seconds
no anomalies in 144 test result(s)
rng=RNG_stdin8, seed=unknown
length= 4 gigabytes (2^32 bytes), time= 224 seconds
no anomalies in 151 test result(s)
Quote:
type file1 | rng_test stdin8 -te 1 -tlmin 10 -tlmax 50 -tlmaxonly
Quote:
RNG_test using PractRand version 0.94
RNG = RNG_stdin8, seed = unknown
test set = expanded, folding = standard (8 bit)
rng=RNG_stdin8, seed=unknown
length= 1 kilobyte (2^10 bytes), time= 0.2 seconds
Test Name Raw Processed Evaluation
FPF-14+6/64:all R= +13.2 p~= 1e-3 unusual
...and 15 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 2 kilobytes (2^11 bytes), time= 1.1 seconds
Test Name Raw Processed Evaluation
DC6-9x1Bytes-1 R= +6.0 p = 0.013 unusual
...and 20 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 4 kilobytes (2^12 bytes), time= 1.9 seconds
no anomalies in 29 test result(s)
rng=RNG_stdin8, seed=unknown
length= 8 kilobytes (2^13 bytes), time= 2.9 seconds
no anomalies in 52 test result(s)
rng=RNG_stdin8, seed=unknown
length= 16 kilobytes (2^14 bytes), time= 4.6 seconds
no anomalies in 62 test result(s)
rng=RNG_stdin8, seed=unknown
length= 32 kilobytes (2^15 bytes), time= 6.3 seconds
no anomalies in 76 test result(s)
rng=RNG_stdin8, seed=unknown
length= 64 kilobytes (2^16 bytes), time= 8.1 seconds
no anomalies in 91 test result(s)
rng=RNG_stdin8, seed=unknown
length= 128 kilobytes (2^17 bytes), time= 9.9 seconds
Test Name Raw Processed Evaluation
DC6-9x1Bytes-1 R= -4.7 p =1-5.0e-3 unusual
...and 101 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 256 kilobytes (2^18 bytes), time= 11.8 seconds
Test Name Raw Processed Evaluation
[Low1/8]FPF-14+6/16:all R= +6.7 p = 2.8e-4 unusual
...and 114 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 512 kilobytes (2^19 bytes), time= 13.6 seconds
no anomalies in 129 test result(s)
rng=RNG_stdin8, seed=unknown
length= 1 megabyte (2^20 bytes), time= 15.5 seconds
no anomalies in 142 test result(s)
rng=RNG_stdin8, seed=unknown
length= 2 megabytes (2^21 bytes), time= 17.5 seconds
Test Name Raw Processed Evaluation
[Low1/8]BCFN(0+1,13-8,T) R= +12.3 p = 4.6e-4 unusual
...and 155 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 4 megabytes (2^22 bytes), time= 19.6 seconds
no anomalies in 169 test result(s)
rng=RNG_stdin8, seed=unknown
length= 8 megabytes (2^23 bytes), time= 22.0 seconds
no anomalies in 183 test result(s)
rng=RNG_stdin8, seed=unknown
length= 16 megabytes (2^24 bytes), time= 24.9 seconds
no anomalies in 198 test result(s)
rng=RNG_stdin8, seed=unknown
length= 32 megabytes (2^25 bytes), time= 28.8 seconds
no anomalies in 212 test result(s)
rng=RNG_stdin8, seed=unknown
length= 64 megabytes (2^26 bytes), time= 34.8 seconds
no anomalies in 225 test result(s)
rng=RNG_stdin8, seed=unknown
length= 128 megabytes (2^27 bytes), time= 44.7 seconds
Test Name Raw Processed Evaluation
[Low1/8]DC6-6x2Bytes-1 R= +5.6 p = 2.0e-3 unusual
...and 239 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 256 megabytes (2^28 bytes), time= 62.9 seconds
no anomalies in 254 test result(s)
rng=RNG_stdin8, seed=unknown
length= 512 megabytes (2^29 bytes), time= 95.8 seconds
Test Name Raw Processed Evaluation
[Low1/8]DC6-9x1Bytes-1 R= -4.3 p =1-3.8e-3 unusual
...and 267 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 1 gigabyte (2^30 bytes), time= 169 seconds
no anomalies in 287 test result(s)
rng=RNG_stdin8, seed=unknown
length= 2 gigabytes (2^31 bytes), time= 300 seconds
no anomalies in 304 test result(s)
rng=RNG_stdin8, seed=unknown
length= 4 gigabytes (2^32 bytes), time= 546 seconds
no anomalies in 318 test result(s)
I did the same on a 8MB file and 10 zeros at offset 3BA5BB -> no detection
I did the same on a 1MB file and 10 zeros at offset 3BA5B -> no detection
I did the same on a 1MB file and 20 zeros at offset 3BA5B -> no detection
I did the same on a 1MB file and 30 zeros at offset 3BA5B -> detection with "midly suspicious" or "very suspicious"Quote:
RNG_test using PractRand version 0.94
RNG = RNG_stdin8, seed = unknown
test set = expanded, folding = standard (8 bit)
rng=RNG_stdin8, seed=unknown
length= 1 kilobyte (2^10 bytes), time= 0.2 seconds
Test Name Raw Processed Evaluation
FPF-14+6/64:all R= +13.2 p~= 1e-3 unusual
...and 15 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 2 kilobytes (2^11 bytes), time= 1.0 seconds
no anomalies in 21 test result(s)
rng=RNG_stdin8, seed=unknown
length= 4 kilobytes (2^12 bytes), time= 1.9 seconds
no anomalies in 29 test result(s)
rng=RNG_stdin8, seed=unknown
length= 8 kilobytes (2^13 bytes), time= 2.9 seconds
no anomalies in 52 test result(s)
rng=RNG_stdin8, seed=unknown
length= 16 kilobytes (2^14 bytes), time= 4.6 seconds
no anomalies in 62 test result(s)
rng=RNG_stdin8, seed=unknown
length= 32 kilobytes (2^15 bytes), time= 6.3 seconds
no anomalies in 76 test result(s)
rng=RNG_stdin8, seed=unknown
length= 64 kilobytes (2^16 bytes), time= 8.1 seconds
no anomalies in 91 test result(s)
rng=RNG_stdin8, seed=unknown
length= 128 kilobytes (2^17 bytes), time= 9.9 seconds
no anomalies in 102 test result(s)
rng=RNG_stdin8, seed=unknown
length= 256 kilobytes (2^18 bytes), time= 11.8 seconds
Test Name Raw Processed Evaluation
FPF-14+6/4:cross R= +6.0 p = 4.5e-5 mildly suspicious
...and 114 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 512 kilobytes (2^19 bytes), time= 13.6 seconds
Test Name Raw Processed Evaluation
FPF-14+6/4:cross R= +4.6 p = 5.5e-4 unusual
...and 128 test result(s) without anomalies
rng=RNG_stdin8, seed=unknown
length= 1 megabyte (2^20 bytes), time= 15.6 seconds
no anomalies in 142 test result(s)
Here are 3 files AES 128 modified at 0x3BA5B :file1: 10 zero bytes -> no detection
file2: 20 zero bytes -> no detection
file3: 30 zero bytes -> detection
Attachment:
random.zip [3 MiB]
Downloaded 42 times
I did the same test on 8GB file.
Test on 8GB at offset 0x3BA5BB24
-20 zero bytes - >no detection
-30 zero bytes -> unusual
-40 zero bytes -> very suspiciousOther people also find that Practrand is not a good detector :
https://crypto.stackexchange.com/questi ... -generatorI remind you that arlet-minimal FAIL on 8kb:Quote:
state: .byte $00,$00,$00,$00,$01
length= 8 kilobytes (2^13 bytes), time= 6.3 seconds
Test Name Raw Processed Evaluation
[Low1/8]FPF-14+6/64:all R= +49.9 p~= 6e-23 FAIL !!
...and 51 test result(s) without anomalies
and arlet-big is MIDLY SUSPICIOUS on 8kb :Quote:
with s: .byte $00,$00,$00,$00,$00,$01
length= 8 kilobytes (2^13 bytes), time= 6.3 seconds
Test Name Raw Processed Evaluation
FPF-14+6/16:all R= +10.3 p = 3.2e-5 mildly suspicious
[Low1/8]FPF-14+6/64:all R= +16.3 p~= 1e-4 unusual
...and 50 test result(s) without anomalies