RNG security risks Archives

popup test

pop test

Interested in future-proof, turnkey RNG security technologies?

Szrek2Solutions provides complete secure solutions for RNG platforms and electronic draw systems for all lottery games.

For more information, read our whitepaper Redefining Electronic Draw Security

White Paper

Szrek's Patent manages the outcomes of games of chance with transparency and integrity

Szrek Receives Patent for Method for Selling Lottery Tickets from Pos Terminal

Method of generating unpreditable and auditable random numbers

When the digital signature is used as random number seed, every specific random number derived from this seed is also verifiable. Because an incorruptible clock is also digitally signed, the time of the signing operation is also verifiable. Each time the HSM generates a signature, the internal embedded counter is incremented and signed. This way each signature and every random number generated is accounted for. In addition, the method allows verification of the specific HSM being used and any additional draw information: since draw information is digitally signed (e.g. personnel conducting the draw, etc.) it can be verified. LYNKS II Security certified by NIST.

Szrek provides a secure and reliable method for random numbers generation based on its patented method of RNG non-repudiation (patent nr 6,934,846). The method is based on asymmetric properties of digital signatures, where a digital signature generated with a private key is used as a random number seed. Random numbers are derived from the seed, and since the seed is a digital signature of draw data it can be verified using the public key, along with the random numbers and the draw data. For digital
signing, Trusted Draw uses secure and tamper evident NIST certified Hardware Security Modules (HSMs).

The unique benefit of Szrek RNG technology is that generated unpredictable and unbiased random numbers can be mathematically verified to detect any potential fraud. The RNG has been certified by several US and international independent labs and has been used successfully since 2005 by numerous lottery operators and state licensed lotteries around the world.

FAQ

Does certification ensure RNG security?

Certifying an RNG does not usually address security. Certification is important and it is typically done to guarantee randomness, but rarely does it address RNG security. Hence security must be addressed specifically and in a different way.

What kind of security measures are there to protect an RNG?

RNG Vendors work with lotteries to establish many important preventive security features that are aimed at limiting access to the RNG (not allowing for an open network, password protection, locks and keys, use of various users to oversee the draw). By limiting access, they protect the RNG from many types of attacks. However, these systems are vulnerable to some types of attacks, particularly attacks from insiders.

We also introduce protective measures, but our security offers a solution that rests within the system – this is why we say it is a different paradigm. Our technology combines cryptographic hardware and software solutions that enable us to detect traces of any manipulation to the RNG, without relying on anything outside of the system. Manipulations cannot be erased or hidden without leaving a trace, unlike those used by other methods of logs and traces, so trying to break into the RNG will always be useless!

What are the limitations of preventive security?

The industry has gained experience from the recent Hot Lotto fraud and other incident about how to respond to known vectors of attack. Although far from perfect, we have some methods for trying to address these attacks. However, with advances in technology there may be new methods of attack forthcoming, and systems are vulnerable to these attacks particularly if they are executed by skilled insiders. This is the limitation of preventive methods – you can only try to prevent against known methods of attack.

This is why you need a methodology that protects against all vectors of attack, known or unknown. Our RNG technology detects every manipulation to the RNG because any manipulation to software, hardware, or otherwise would leave a trace and affect its functioning, causing the RNG and Systemic Independent Audit to have different draw results.

What type of audit is available for RNG systems?

Some people believe that having an auditor present during the draw is sufficient for RNG security, because the auditor by witnessing the draw can verify data consistency and ensure that procedures are followed. However an auditor may not be able to detect what is not visible. For other areas in the lottery, such as gaming systems and lottery tickets, independent system verification is required.

The Szrek2Solutions System offers Systemic Independent Audit that verifies the inner-workings of the RNG, rather the external processes that were used. The Systemic Independent Audit actually uses an independent system to recreate the draw based on the data that the RNG created. This Systemic Independent Audit will recreate the exact same output if the draw was not manipulated. If there was any manipulation, this would affect the data created by the RNG, and then the Systemic Independent Audit would recreate a different draw, providing evidence of tampering with the system.

Draw time substitution after the results are generated

The time stamp for offline draws can be altered, meaning draw results can be known before they are published.

Hardware substitution for alternative hardware that produces predictable results

Such substitution may go unnoticed unless there is a way to identify the hardware used for each draw

Substitution of numbers drawn after the results are generated

An insider can substitute the winning numbers and this can go unnoticed if the RNG system does not provide verification methods and the results are not consistently verified.

Software substitution during initial delivery, during maintenance, or later

Certification, pre-post testing, verification of program checksums, system scans, verification tests, and post-mortem testing may not find the hidden code.

Phishing or attempting multiple RNG generations to obtain desired outcomes

Traditional RNGs allow for multiple generations and it may be impossible to know how many have occurred.

Hardware deterioration results in hardware not performing RNG functions safely or properly

Traditional RNGs may not have specific hardware verification tests in place.

Inadequate RNG design & implementation detection of software and hardware errors and malfunctions

Software designed to check for errors, detect hardware issues and malfunction

certifications

Our games have been certified in 4 continents

integrity assurance

differentiators

company

Superior knowledge of RNG solutions and implementations
High awareness of system security issues
Extensive technology expertise
Vast lottery / transaction systems experience
The ability to provide custom solutions that address complex or unique requirements
Concentration on software technologies and a systemic approach
100% focus on electronic drawing systems

product

Superior security and fraud detection capabilities
Reliability and superior quality: 100 % availability with 0 hotline calls since our first day of operations in 2005
Scalable and flexible product architecture that supports standalone systems, remote operation, on-line connected systems, and multitenant systems
The simple and intuitive drawing system interface (Draw GUI) designed by user experience professionals
Complete RNG solution for gaming supporting draw games, instant winners, quick-picks and providing audit and monitoring.
Audit capability built into products to verify integrity and provide fraud detection both during the draw process as well as at any time in the future

history

Szrek2Solutions, LLC (S2S) was founded in 2003 by Irena and Walter Szrek, both with over 20 years of experience in on-line lottery systems. Previously they contributed to GTECH Corporation’s growth from a small startup into an industry leader in lottery systems.
Irena and Walter Szrek designed the concept of an auditable Random Number Generator (RNG) – of an RNG with fraud-detection – and they developed a company around this breakthrough concept. They patented this RNG methodology and developed the Trusted Product SuiteTM by extending ideas from this initial patent and from consequent patents. Since the beginning, the focus of Szrek2Solutions has been on the RNG system’s transparency, integrity, and security, while always developing very high performance and reliable systems.

The company’s ﬁrst customer was Danske Spil in 2005, where Szrek2Solutions provided a very advanced RNG system for instant games, a system that is still advanced over a decade later. Over the years, the company served customers across four different continents. The company has had 0 hotline calls and 100% uptime and reliability since inception.
The company now, although somewhat larger, remains committed to these same principles. Szrek2Solutions continues to develop secure innovative solutions, investing on average 20% of its revenue in Research and Development. It remains the only company in the lottery industry with full proof of integrity / 100% fraud detection technology.

Recent News

RNG security risks

Currently browsing: RNG security risks

Typical RNG security risks and available defenses against insider fraud.