What is the use of REAL random number generators in cryptography? I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators.

However, I don't understand for what a real random number generator is used.
If it is not deterministic, how can it be used in an algorithm?
For some types of algorithms (or protocols) we only need non-guessable (by the attacker) bits/numbers, not reproducible non-guessable ones (like from a deterministic PRNG).

In this cases, "real" random numbers are in theory (i.e. from an information-theoretic point of view, not a cryptographic one) better, since they can't be guessed (or even influenced) by an attacker, even if she could break our PRNG.

Some cases that I can now think of, where we don't need deterministic random numbers:


key generation (both symmetric and asymmetric)
initialization vectors for block cipher modes of operation (these are usually sent with the message, so the same plaintext will not result in recognizable ciphertext for the next message)
random padding in asymmetric encryption (for example OAEP)
salts for password storage (these are stored with the hash)
challenges in zero knowledge proofs (sent to the partner)
random values used in digital signatures (the k in DSA)
one time pads (OTP)  (Here, for the security proof, we actually need "real" random numbers.)
chaffing and winnowing


In practice, pseudo-random bits are cheaper and just as secure for real-world attackers (e.g. with resources limited by our earth mass and universe lifetime), as long as the PRNG is not broken and has enough entropy input to start with.

(If the attacker can control the seemingly random input to the "true random" generator, this would be even worse than a good PRNG.)

Often for these uses we use a combination of a cryptographically secure (deterministic) PRNG and an entropy pool, which gets filled (and re-filled) by random bits gathered by the OS. This would be a non-deterministic PRNG.