Why randomness doesn't exist in computer science?

In a previous article, I argued that randomness doesn't exist in computing, but today I'd like to explain why it doesn't exist, or at least, not really.

Because yes, you need to be careful when talking about the generation of a random number by computers.

We can say that there are three types of randomness in computing:

• Absolute (theoretical) randomness
• Real (extrinsic) randomness
• Pseudo-randomness (intrinsic)

Let's now look at the difference between these three concepts in a simple and understandable way.

1 - Absolute randomness

Let's start by defining the general notion of randomness using one of its synonyms: random means unpredictable.

Since nature is well designed, it turns out that randomness is all around us. The laws of our universe are governed by a science called quantum physics.

Don't worry, you don't need to be a physicist to understand the rest of the article.

One of the characteristics of quantum physics is its unpredictability, since it isn't based on known exact measurements, but on a set of probabilities.

To give you an example, without going into detail, it is physically impossible to predict exactly the rate of radioactive decay of an atom (this is just one example among many).

Here, impossible doesn't mean "impossible with our current techniques," but truly, factually impossible according to the laws of physics.

So there are, in nature, examples of absolute randomness.

If a computer system were able to precisely and efficiently evaluate this decay at a given instant t, we would be able to generate a truly, and perfectly, random number.

A number, entirely unpredictable in advance.

It's certain that integrating such systems for measuring physical events inside the average person's computer is unthinkable, and so absolute randomness doesn't exist in classical computing.

Conversely, a quantum computer will be able to generate an absolute random number because its operation is directly based on this non-deterministic physics.

For our classical computing, the kind we use every day, we therefore have to rely on more realistic methods, presented right after.

2 - Real randomness

The purpose of a random number, particularly in cryptography, is to be sufficiently unpredictable so that an attacker cannot guess its value.

And in this case, our computers are capable of generating such numbers, except that since their system is specifically based on logic, they need outside help in the form of unpredictable data.

By using data external to the system in question (extrinsic), we're then able to generate a sufficiently random number to be used in real-world conditions.

For example, such a function might use the position of the user's mouse at a given instant t, or the rotation speed of the fan blades, or even the CPU temperature to generate a sufficiently random number.

Even though these values aren't perfectly random in the physical sense of the term, it would be infinitely difficult for an attacker to predict the exact value of these numbers.

This type of real randomness is therefore sufficient for the most critical uses, cryptography in particular, but not absolute.

Nevertheless, this means that if an attacker has direct access to the machine itself, they could (in theory) manage to reproduce these random numbers by intercepting the data used.

There are even experiments showing that it's possible to decrypt an RSA key through analysis of the sound produced by the machine's fan: https://www.cs.tau.ac.il/~tromer/acoustic/

3 - Pseudo-randomness

Here we're talking about the most common type of randomness, using the machine's internal (intrinsic) parameters and serving mainly for business logic, such as returning a list of resources sorted randomly, for example.

Most of the time these methods use mathematical functions along with a time-based factor in order to generate a quasi-random number, sufficient for non-critical use, but far from being secure randomness.

Here, for example, is an article explaining the implementation of the Math.random() function in Javascript, clearly showing that it's simply a pseudo-random number: https://v8.dev/blog/math-random