Fast crytographically secure Pseudo-Random number generator in software What are the methods for generating pseudo-random numbers in software? I have seen methods where people use SHA implementations from openssl to hash a random message as source of entropy, or using AES or Keccak. But I have done some experiments and found them quite slow. They take around more than 3 clock cycles in an intel 3.3GHz i5 processor to generate a random bit. Whereas pseudo-random generators like ISAAC are blazingly fast compared to other methods. Now my question is


Why don't people use ISAAC for their implementations?
Is ISAAC not secure enough for cryptographic applications?
What are the other methods available for fast pseudo random number generation?


Thank you for your help.
What are the methods for generating pseudo-random numbers in software?
What are the other methods available for fast pseudo random number generation?

If you don't need to be able to repeat the stream of numbers, there is little reason not to use the methods provided by the operating system - namely, urandom on linux, and CryptGenRandom in Windows. The RDRAND CPU instruction is another option, though it is often times combined with other sources of random number generation, as not everyone trusts it completely (you can ignore this unless you are dead set on obtaining absolutely secure random numbers).
Otherwise, assuming a modern CPU with AES-NI support, nothing will likely be faster then utilizing AES in CTR mode. There is no need to hash the output, this is just eating cycles for no statistical or security benefit.

Why don't people use ISAAC for their implementations?

We can only conjecture at the motivations of others. Some reasons might include:

ISAAC is not a hugely well known algorithm in the same tier as AES or salsa20

If they are not aware it's existence, they will not use it


Their requirements may be satisfied with simpler/more commonly used algorithms
Secure random numbers are not always required; Often times, numbers that look random enough work just fine.
On the other hand, sometimes security is required, as well as conformance to a particular security standard. ISAAC is not a standardized (read: officially prescribed) algorithm for use as a PRNG by any official organizations i.e. NIST.

AES-CTR-DRBG is a standards compliant PRNG.




Is ISAAC not secure enough for cryptographic applications?

The jury appears to be out on this one. There was a reason to prompt the author to design ISAAC+, so while there is no known attack that breaks it outright, it does provide less assurance then a thoroughly reviewed design such as AES or salsa20.