Lion Cipher Lab
Predict a Mersenne Twister (MT19937) PRNG from its output — then switch to a CSPRNG and watch the attack die
- Foundations
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Almost every language ships a fast general-purpose random number generator, and in most of them it is the Mersenne Twister — Python's random module, Ruby's Random, PHP's mt_rand, NumPy's legacy RandomState. It is genuinely excellent for simulations and games: it is fast and its output passes the hard statistical randomness batteries. And that is exactly the trap, because developers reach for the thing called 'random' to mint security tokens — password-reset links, coupon codes, session ids, API keys, 'unguessable' URLs — and the Mersenne Twister is NOT cryptographically secure. The Python…
What you'll learn
- explaining the difference between a PRNG and a CSPRNG, and why statistical randomness (passing Diehard/TestU01) is not the same property as cryptographic unpredictability
- implementing the MT19937 untempering step in pure Python — inverting the four right/left shift-xor-mask operations that temper each state word into an output
- recovering all 624 internal state words from 624 consecutive 32-bit outputs, cloning the generator with random.setstate(), and predicting future outputs exactly
- demonstrating a real-world consequence: predicting the NEXT 'random' security token (reset link / coupon / session id) after observing earlier ones
- brute-forcing a weak time-based seed over a known window from a single observed output, and judging when that is easier than full state recovery
- replacing the insecure source with a CSPRNG (secrets.token_hex / secrets.randbits / os.urandom) and measuring prediction accuracy collapse to chance
- recognising the conditions the state-recovery attack needs — 624 full, consecutive, untruncated outputs in order — and why truncation, gaps or reseeding break it
Steps in this lab
- PRNG vs CSPRNG: the one distinction this whole lab rests on
- Set up, and understand the target: how MT19937 turns state into output
- Implement untemper, recover the state, and predict every future token
- The often-EASIER break: a weak seed over a time window
- The fix: mint tokens with a CSPRNG, then rerun the identical attack
- Honest negatives — exactly when the state-recovery attack gets HARD
- The judgment: what to actually take away