Counter-based random number generator (CBRNG)
A counter-based random number generation (CBRNG, also known as a counter-based pseudo-random number generator, or CBPRNG) is a kind of pseudorandom number generator that uses only an integer counter as its internal state. Background. We can think of a pseudorandom number generator (PRNG) as a function that transforms a series of bits known as the "state" into a new state and a random number. That is, given a PRNG function and an initial state formula_1, we can repeatedly use the PRNG to generate a sequence of states and random numbers. formula_2  In some PRNGs, such as the Mersenne Twister, the state is large, more than 2048 bytes. In other PRNGs, such as xorshift, formula_3 and formula_4 are one and the same (and so the state is small, just 4, 8, or 16 bytes, depending on the size of the numbers being generated). But in both cases, and indeed in most traditional PRNGs, the state evolves unpredictably, so if you want to calculate a particular formula_3 given an initial state formula_1, you have to calculate formula_7, formula_8, and so on, running the PRNG formula_9 times. Such algorithms are inherently "sequential" and not  amenable to running on parallel machines like multi-core CPUs and GPUs. In contrast, a counter-based random number generator (CBRNG) is a PRNG where the state "evolves" in a particularly simple manner: formula_10. This way you can generate each number independently, without knowing the result of the previous call to the PRNG. This property make it easy to run a CBRNG on a multiple CPU threads or a GPU. For example, to generate formula_11 random numbers on a GPU, you might spawn formula_11 threads and have the formula_9th thread calculate formula_14. CBRNGs based on block ciphers. Some CBRNGs are  based on reduced-strength versions of block ciphers. Below we explain how this works. When using a cryptograhpic block cipher in counter mode, you generate a series of blocks of random bits. The formula_9th block is calculated by encrypting the number formula_9 using the encryption key formula_17: formula_18. This is similar to a CBRNG, where you calculate the formula_9th random number as formula_14. Indeed, any block cipher can be used as a CBRNG; simply let formula_21! This yields a strong, cryptographically-secure source of randomness. But cryptographically-secure pseudorandom number generators tend to be slow compared to insecure PRNGs, and  in practice many uses of random numbers don't require this degree of security. In 2011, Salmon et al. at D. E. Shaw Research introduced two CBRNGs based on reduced-strength versions of block ciphers. ARS is used in recent versions of Intel's Math Kernel Library and gets good performance by using instructions from the AES-NI instruction set, which specifically accelerate AES encryption. Code implementing Threefry, ARS, and Philox (see below) is available from the authors. CBRNGs based on multiplication. In addition to Threefry and ARS, Salmon et al. described a third counter-based PRNG, Philox. It's  based on wide multiplies, e.g. multiplying two 32-bit numbers and producing a 64-bit number, or multiplying two 64-bit numbers and producing a 128-bit number. As of 2020, Philox is popular on CPUs and GPUs. On GPUs, nVidia's cuRAND library and TensorFlow provide implementations of Philox. On CPUs, Intel's MKL provides an implementation.