Can a cryptographic hash algorithm be used as a PRNG?

Question

Can MD5/SHA256/SHA512, etc., be used as a PRNG? E.g., given an integer seed, is the pseudo-code:

random_number = truncate_to_desired_range(
    sha512( seed.toString() + ',' + i.toString() )

…a decent PRNG? (i is an increasing integer, e.g., the outputs are:

convert(sha512("<seed>,0"))
convert(sha512("<seed>,1"))
convert(sha512("<seed>,2"))
convert(sha512("<seed>,3"))
…

"Decent", in the context of this question, refers only to the distribution of the output: is the output of cryptographic hash functions uniform, when used this way? (Though I suppose it would depend on the hash function, all cryptographic hashes should also have uniform output, right?)

Note: I will concede that this is going to be a slow PRNG, compared to say Mersenne-Twister, due to the use of a cryptographic hash. I'm not interested in speed, and I'm not interested in the result being secure — just that the distribution is correct.

In my particular use case, I'm looking for something similar to XKCD's geohashing, in that it is easily implemented by distributed parties, who will all arrive at the same answer. Mersenne-Twister can be substituted, but it less available in many target languages. (Some languages lack it entirely, some lack access to the raw U32 output of it, etc. SHA512 is either built in, or easily available.)

If your seed is only a 32 bit integer, it's not that difficult to bruteforce all of the possible seed values. — Blender
@Blender: I'm not particularly worried about security. (It's not being used in a security context.) But yes, given a small seed, I agree. Let's assume I'm using a seed large enough to handle all outputs. (In my particular use case, there will be ~600 outputs over the next hundred years…) — Thanatos

Thomas Thomas · Accepted Answer · 2013-01-22T21:06:36

Assuming the cryptographic hash function meets its design goals, the output will (provably) follow a uniform distribution over its period, as every input to the hash function is unique by design.

One of the goals of a hash function is to approximate a random oracle, that is, for any two distinct inputs A and B, the outputs H(A) and H(B) should (for a true random oracle) be uncorrelated. Hash functions get pretty close to that, but of course weaknesses creep in with time and cryptanalysis.

That said, cryptographic primitives are essentially the best mathematical algorithms we have available when it comes to quality, therefore it is safe to say that if they cannot solve your problem, nothing will.

Can a cryptographic hash algorithm be used as a PRNG?

2 Answers