# Tag Info

5

Each biased die result has >2.52 bits of Shannon entropy. Each unbiased die result has <2.59. So 21 biased rolls have more entropy than 20 unbiased ones. Alice can concatenate 21 biased results into $r$ and use $r_i = H(s||r||i) \bmod 6$ as the unbiased results, where $H$ is a hash function like SHA-256 and $s$ is a unique salt she decides just before ...

3

A simple solution is that Alice repeats until 20 values have been output: throw the dice if the dice gave other than a 6, output what it gave; else throw the dice until it gives other than 1, then output 6 if the dice last gave 5 or 6 (otherwise, output nothing). Proof of correctness: at each outer loop, values 1 to 5 are output with odds $1\over7$ ...

2

Since you are looking for an algorithm that guarantees entropy for the output if the input it entropic, you are not actually looking for a PRNG, which would expand a seed to a longer random output, but only a transformation from a binary sequence to arbitrary values. You can achieve this using arithmetic coding, or range encoding, which is the same thing in ...

4

Your diagram is a Venn diagram that illustrates the information measures between the correlated random variables $X,Y$ and $Z$. $H(X)$ refers to a complete circle and is the entropy of $X$, $H(X|YZ)$ is the entropy of $X$ under the observation of $Y$ and $Z$, $I(X;Y|Z)$ is the mutual information between $X$ and $Y$ under the observation Z, $R(X;Y;Z)$ ...

4

It is possible to reverse the birthday bound calculation. You can get an easily computable approximation using the expected number of collisions: If you had random $n$-bit salts, after $k$ values you would expect $2^{-n}\binom{k}{2}$ collisions. If the collisions are rare, they are mostly single collisions, so there are approximately \$u = ...

1

Unrelated to your question premise, but highly related to the security of the overall scheme is that you may be opening yourself up to a side channel attack. Your supposition about the randomness may hold true as long as the hardware is secure, but if someone gains access to the device, they may be able to make your numbers less than random. This may range ...

7

The Intel post which I think you mean was discussed in this question and as I wrote there, the limitation only applies in the case of trying to combine PRNG outputs into values larger than the seed entropy (two 256-bit values in their case). Also mentioned there: cryptographic mixing does not increase the entropy you have, so if concatenation is insecure, ...

Top 50 recent answers are included