TRNGs vs. PRNGs

Technology decisions are all about trade-offs, as I’ve mentioned, and both TRNGs and PRNGs have their pros and cons. The major advantage of TRNGs is that their numbers are much closer to being truly random; that is, the numbers are way less predictable. (Can you predict what the next lava lamp formation is going to look like?) PRNG numbers, on the other hand, are completely predictable once you know which formula is being used to fuel the PRNG.

Sometimes this difference is critical, as there are numerous applications where only truly random numbers will do. One of the most prominent examples is cryptography, which relies on the random generation of passwords and secret keys. For example, when we sign up for a new online service, our Internet browser asks us if it should generate a random password for us. If these passwords were only pseudorandom and generated using a predictable pattern, hackers would have a heyday breaking into people’s accounts.

Another example is casino software. If a smart person could predict the combination of cards that the electronic poker machine will deal out next, the casino would go out of business fast. Even if something like Mersenne Twister is being used under the hood, a hacker may be able to find out the precise random number previously generated, and thereby be able to predict the next one.

For applications like these, PRNGs like Mersenne Twister aren’t up to snuff. In the words of Python’s documentation of the random module, “The Mersenne Twister is one of the most extensively tested random number generators in existence. However, being completely deterministic, it is not suitable for all purposes, and is completely unsuitable for cryptographic purposes.”

On the other hand, for applications that don’t absolutely need “true” random numbers, PRNGs have distinct advantages. First, PRNGs are practical; no radioactive material is needed. Secondly, PRNGs are generally faster, as a computer only needs to make an internal mathematical computation.

It should be noted that there’s also a type of random number generator called a Cryptographically Secure Pseudorandom Number Generator, or CSPRNG, which attempts to grab all the advantages of both PRNG and TRNG. That is, the computation is practical, fast, and cryptographically secure all at the same time. However, while CSPRNGs are indeed faster than TRNGs, they’re generally not as fast as PRNGs. On the flip side, while CSPRNGs are much more secure than PRNGs, they’re not as secure as TRNGs. So, it’s a compromise that is appropriate for certain scenarios. A competent cybersecurity professional should be consulted if you’re not sure whether you should be using a CSPRNG or a TRNG.

So much more can be said regarding generating random numbers, but it’s time to get back to the topic of randomized algorithms. In particular, let’s look at how to figure out the time complexity of shuffling an array.