# Tag Info

5

Each biased die result has >2.52 bits of Shannon entropy. Each unbiased die result has <2.59. So 21 biased rolls have more entropy than 20 unbiased ones. Alice can concatenate 21 biased results into $r$ and use $r_i = H(s||r||i) \bmod 6$ as the unbiased results, where $H$ is a hash function like SHA-256 and $s$ is a unique salt she decides just before ...

3

A simple solution is that Alice repeats until 20 values have been output: throw the dice if the dice gave other than a 6, output what it gave; else throw the dice until it gives other than 1, then output 6 if the dice last gave 5 or 6 (otherwise, output nothing). Proof of correctness: at each outer loop, values 1 to 5 are output with odds $1\over7$ ...

1

Consider the limitations of such an analysis. It can summarily reject a PRNG as being insufficiently random by demonstrating that the outputs are predictable by a computer program. However, its ability to generate comfort as to the randomness of a PRNG is limited. We have mathematicians going through hoops with months of mathematical analysis to prove ...

14

We simply strive for crypto that's as close as possible to ideal. Indistinguishably is the strongest property we can demand from a PRNG/streamcipher. It's hard to predict which non ideal properties will lead to problems at some point in the future. For example the non ideal properties that lead to padding oracles, BEAST, CRIME or the RC4 biases were known ...

1

If you can distinguish a source from true random, then that can directly translate into less guesses required in order to brute force a decryption - recovering the internal RNG state, which may lead to further attacks into decryption or key recovery, depending on what other resources an attacker can control. If I know probabilities of some output bits are ...

2

A PRNG must be indistinguishable from a true RNG only in a complexity theoretic sense. No polynomial (efficient) algorithm must be able to distinguish both. The fact that a true RNG has more collisions (by the birthday paradox) then a PRNG (say, running in counter mode) is not distinguishable by a polynomial algorithm.

0

You may use binary classification algorithm like decision tree and have two learning data sets one which has the truly random bytes and the other puesudo random bytes. As you might probably know, you have to specify the size of every record say for example 1k. It is really a good idea.

5

A PRNG has an internal finite state. The value of that state determines all subsequent outputs; that's the point of the PRNG being a deterministic engine. Whenever the PRNG produces a new output element, its internal state evolves into a new value. Since the internal state is finite in size, it is a mathematical certainty that the PRNG, at some points, ...

7

Take a block cipher with a random key and for one generator encrypt the even numbers then with the other generator encrypt the odd numbers. Your output blocks will be pseudo-random and distinct. For more than two generators just partition the inputs accordingly.

2

Since you are looking for an algorithm that guarantees entropy for the output if the input it entropic, you are not actually looking for a PRNG, which would expand a seed to a longer random output, but only a transformation from a binary sequence to arbitrary values. You can achieve this using arithmetic coding, or range encoding, which is the same thing in ...

1

Unrelated to your question premise, but highly related to the security of the overall scheme is that you may be opening yourself up to a side channel attack. Your supposition about the randomness may hold true as long as the hardware is secure, but if someone gains access to the device, they may be able to make your numbers less than random. This may range ...

1

The only really effective way of using OTPs is running a Numbers Station. Or at least relaying your message through a Numbers Station. I would check out a document called "Guide to Secure Communications using the One Time Pad" (PDF) for proper CryptSec and OpSec procedures when it comes to using them in the field.

7

The Intel post which I think you mean was discussed in this question and as I wrote there, the limitation only applies in the case of trying to combine PRNG outputs into values larger than the seed entropy (two 256-bit values in their case). Also mentioned there: cryptographic mixing does not increase the entropy you have, so if concatenation is insecure, ...

5

The numbers $n$ (coding source) and $m$ (coding index for a given source) can be combined into a single bitstring; e.g. with $0\le m<2^u$ and $0\le n<2^v$, as a bitstring of $\lceil u+v\rceil$ bits. Then, converting that single bitstring into a unique random-like number can be done by encryption with a secure block cipher with block width $w\ge u+v$ ...

Top 50 recent answers are included