Hot answers tagged randomness
35
For symmetric encryption algorithms, your question is basically "Why do we use AES or DES rather than another function that provides the same properties as AES or DES but forces us to use the second weakest chaining mode and never lets us use the same key twice?" Well, the answer is obvious, we sometimes want strong chaining modes and we often like to use ...
30
There is a theorem in cryptography that states that secure encryption and secure PRNG are equivalent, and in fact you just proved half of it.
Given a secure PRNG, you can create a secure encryption algorithm using the method you just provided (using the password as the PRNG-seed). The other half is that given a secure encryption algorithm, you can create a ...
12
There is a very easy reason why one-time pads are not always used. It requires information sent before the encryption is set up, i.e. both the sender and the recipient need to have access to the pads themselves. That's a big pain, especially if all information was to be sent with one time pads. How would one distribute the pads themselves?
There is also a ...
12
If your system already has some other unique user identifier (be it an ID, user-name, or an EmailAddress) is there any effective decrease in your security if you simply use that value as your salt?
The salt in a hash actually forms two different purposes. Generally, it is acceptable for a salt to be known, so let us consider H() a hash function, S, some ...
11
For some types of algorithms (or protocols) we only need non-guessable (by the attacker) bits/numbers, not reproducible non-guessable ones (like from a deterministic PRNG).
In this cases, "real" random numbers are in theory (i.e. from an information-theoretic point of view, not a cryptographic one) better, since they can't be guessed (or even influenced) by ...
10
There are three general solutions to the non-duplicate random number problem:
If you want a few numbers from a large range then pick one and reject it if it is a duplicate. If the range is large, then this won't cause too many repeated attempts.
If you want a lot of numbers from a small range, then set out all the numbers in an array and shuffle the array. ...
9
If you are doing things right, then you will get the level of randomness you are after. Translation: you are not doing things right. You use AES with CFB8 mode, which requires a random initial value. The initial value is a 16-byte string which should be generated randomly and uniformly, and a new IV shall be generated for every single encrypted message. ...
7
Salts must be unique. Randomness (with a "good" random generator) is sufficient to ensure uniqueness.
A per-user ID (e.g. the user login name) is not sufficient for uniqueness, because it does not capture some occurrences which do happen in practice:
two users on two distinct systems (running the same software) which share the same ID (how many Joes and ...
7
An alternative:
Client generates preliminary keypair $(t, T)$ with $T=tB$
Clients sends $T$ to server
Server sends a random scalar $n$ back(alternatively choose $n = \mathrm{HMAC}(k, T)$ with secret key $k$), and assigns the public key $A = T + nB$ to the client
Client uses $a = t+n$ as private and $A$ as public key.
That way the server decides the ...
6
Already answered here: http://stackoverflow.com/questions/471157/is-a-subset-of-a-random-sequence-also-random , take a look at all the answers.
But, saying in other words:
If you have a list of random bytes, any selection you make in that list will be random as well, according to your selection criteria.
Examples:
if you choose every 3rd element, you'll ...
5
We want a list of $n$ distinct random-like non-negative integers less than $m$, obviously with with $n \le m$.
One option is to build a cipher $C$ over the set of non-negative integers less than $m$; select a fixed random key $K$ for that cipher; and construct the desired list as $C_K(i)$ for $0 \le i \lt n$. The rationale is that a good cipher over a set, ...
5
Many of the uses of a True RNG fall into the general category of generation, without persistent storage, of a value that is different with high probability from any value determined otherwise.
A value that is different with high probability from any value determined otherwise is very useful in cryptographic protocols. For example, under classic CBC ...
5
To expand on rossum's answer:
The Fisher–Yates shuffle is actually quite a versatile algorithm. In particular, you can use it in "on-demand mode", where, whenever you need a new random number, you run one step of the algorithm (Durstenfeld version or equivalent) and output $a[i]$ (where $a$ is the array being shuffled and $i$ is the loop counter).
...
5
The classic way to do this is to have all parties commit to individual random values by publishing a secure hash of a suitably random-nonce-padded number. Once the commitments have been distributed, the parties open the commitments by publishing the nonce and the number. The numbers are combined in some previously agreed suitable fashion such as adding them ...
5
Well, the idea behind randomized encryption is that a single plaintext $P$ can encrypt into many different ciphertexts $C_1, C_2, ..., C_n$, and that when we encrypt, we pick one of those ciphertexts randomly. Of course, because the decryptor has no way to knowing apriori which one we picked, it must be able to map any of those ciphertexts back into the ...
5
A slightly more efficient method to perform decryption would be:
Compute $r^e = (y^d)$
Find the multiplicative inverse $r^{-e}$ of $r^e$ modulo $n$
Compute $m = (r^{-e} \cdot z)^d = (r^{-e} \cdot r^e \cdot m^e) ^d$
This has two computations of $x^d$ for some $x$; your method has three.
On the other hand, this doesn't address your question; if $r^{-1}$ ...
5
Let's look at this from the bottom ("what is random?") to the top (is that secure?).
When we talk about "random" in cryptography we almost always prefer to talk about "entropy". The intuitive and concise definition of cryptographic entropy is that it is a measure of how much information the attacker does not know about the target message. When you hear ...
5
I assume you're referring to section 5 of the paper you linked to, which reads:
5 An instance using polynomials
In this section, we describe an instance of the technique of
Section 4 using Shamir's secret sharing scheme [25]. In this
scheme, $\mathrm{hpwd}_a$ is shared by choosing a random polynomial
$f_a \in \mathbb Z_q[x]$ of degree $m - 1$ ...
5
I do not buy some of HAVEGE, specifically the claim made here "tens of thousands of unpredictable bits can be gathered per operating system call in average", and the methodology used to support that claim, as found here.
Entropy gathering is described by this pseudocode:
where HARDTICK() is a function that reads a hardware clock counter. An experimental ...
5
Evaluating a TRNG device positively requires knowing its structure, both to evaluate the actual amount of entropy it produces, and the possibility to detect a field failure.
Some devices sold as TRNG are in fact a TRNG subsystem followed by a PRNG, which produce the output of the device. In that case, if the PRNG is cryptographically secure, the output of ...
4
With the problem as stated, the main weakness is that knowledge of the 873th to 1000th bits of the sequence is enough to trivially determine its 1001th to 100000th bits. That's because these 873th to 1000th bits are both part of the output and used as seed for the rest of the sequence.
Update: In order to test if a sequence is produced by the stated ...
4
Presuming this documentation is correct, the answer is no, these numbers are not cryptographically secure. The Random class uses a linear congruential formula with a 48 bit seed. For most purposes it is not enough even if you only require 48 bit security. Given a fairly low number of outputs from a LCG, it is possible to derive the seed, even if only a few ...
4
One rationale for avoiding randomized schemes in general, and in MACs in particular, is that the random in such schemes tends to increases the size of cryptograms or reduce the size of the payload. An example is scheme 2 in ISO/IEC 9796-2 RSA signature with message recovery, where the size of the random/salt field is directly antagonist with the amount of ...
4
A service that provides such numbers is called a random beacon.
Since everyone has to agree on what a beacon's value is and peers may not have a complete view of the network, it is very difficult to construct a universally verifiable value using only internal network data. Since data only becomes canonical when it is included in a block (a block that is ...
4
What you ask for is a RNG to produce some output which another RNG will use as seed. This looks quite overly complex...
The point of the seed is to be unknown to the attacker: the seed data should be such that "trying out" possible seed values should not match the actual seed except with negligible probability. With a 64-bit seed, even if the seed is ...
4
That looks about right. Assume we have two messages $m_1$ and $m_2$ and the corresponding signatures $(r,s_1)$ and $(r,s_2)$ generated using the same $k$ (where $r=g^k$ is thus the same for both signatures).
If we could assume that $s_1 - s_2$ and $r$ were invertible modulo $p-1$, we could simply compute
$$ k \equiv (m_1 - m_2)(s_1 - s_2)^{-1} \mod p-1 $$
...
4
First of all, it's not true that, in the "Base Conversion" case, that the output is actually equidistributed. It is easy to show that, if the size of the alphabet isn't a power of 2, and that there is a bound on the amount of entropy you can draw, that no algorithm can generate a truly equidistributed output (although you can come arbitrarily close).
In ...
4
If you want an answer that is maximally efficient in consuming a stream of random bits, then you need a decoder for arithmetic encoding. However if you're using a moderately fast CSPRNG, why would you sacrifice extra clock cycles to squeeze all the biased bits you can from each unbiased bit?
Only top voted, non community-wiki answers of a minimum length are eligible
