Editing Pseudorandom number generator (section)

==BSI evaluation criteria==
The German [[Federal Office for Information Security]] ({{Langx|de|Bundesamt für Sicherheit in der Informationstechnik}}, BSI) has established four criteria for quality of deterministic random number generators.<ref name=bsi_ais20>{{cite web|last=Schindler|first=Werner|title=Functionality Classes and Evaluation Methodology for Deterministic Random Number Generators|url=https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Zertifizierung/Interpretationen/AIS_20_Functionality_Classes_Evaluation_Methodology_DRNG_e.pdf?__blob=publicationFile|work=Anwendungshinweise und Interpretationen (AIS)|publisher=[[Bundesamt für Sicherheit in der Informationstechnik]]|access-date=19 August 2013|pages=5–11|date=2 December 1999}}</ref> They are summarized here:

* K1 – There should be a high probability that generated sequences of random numbers are different from each other.
* K2 – A sequence of numbers is indistinguishable from "truly random" numbers according to specified statistical tests. The tests are the ''[[monobit]]'' test (equal numbers of ones and zeros in the sequence), ''poker'' test (a special instance of the [[chi-squared test]]), ''runs'' test (counts the frequency of runs of various lengths), ''longruns'' test (checks whether there exists any run of length 34 or greater in 20 000 bits of the sequence)—both from [[Federal Office for Information Security|BSI]]<ref name=bsi_ais20 /> and [[NIST]],<ref>{{cite web|title=Security requirements for cryptographic modules |url=http://csrc.nist.gov/publications/fips/fips1401.htm |work=[[Federal Information Processing Standard|FIPS]] |publisher=[[NIST]] |access-date=19 August 2013 |page=4.11.1 Power-Up Tests |date=1994-01-11 |url-status=dead |archive-url=https://web.archive.org/web/20130527090643/http://csrc.nist.gov/publications/fips/fips1401.htm |archive-date=May 27, 2013 }}</ref> and the ''autocorrelation'' test. In essence, these requirements are a test of how well a bit sequence: has zeros and ones equally often; after a sequence of ''n'' zeros (or ones), the next bit  a one (or zero) with probability one-half; and any selected subsequence contains no information about the next element(s) in the sequence.
* K3 – It should be impossible for an attacker (for all practical purposes) to calculate, or otherwise guess, from any given subsequence, any previous or future values in the sequence, nor any inner state of the generator.
* K4 – It should be impossible, for all practical purposes, for an attacker to calculate, or guess from an inner state of the generator, any previous numbers in the sequence or any previous inner generator states.

For cryptographic applications, only generators meeting the K3 or K4 standards are acceptable.