# Tag Info

91

The main difficulty with the one-time pad is that it requires pre-arrangement. In order for me to use a one-time pad to communicate with you, we must either have arranged ahead of time for a one-time pad that we will use (which must be as large as our communication will be), or else we must have some secure way of communicating that will allow us to agree on ...

40

For symmetric encryption algorithms, your question is basically "Why do we use AES or DES rather than another function that provides the same properties as AES or DES but forces us to use the second weakest chaining mode and never lets us use the same key twice?" Well, the answer is obvious, we sometimes want strong chaining modes and we often like to use ...

35

There is a theorem in cryptography that states that secure encryption and secure PRNG are equivalent, and in fact you just proved half of it. Given a secure PRNG, you can create a secure encryption algorithm using the method you just provided (using the key as the PRNG-seed). The other half is that given a secure encryption algorithm, you can create a ...

32

1 - How feasible is it that the chip's manufacturer can predict the output of this PRNG when it passed tests from the people applying the use of this RdRand instruction in kernels? A strong stream cipher's output is random and unpredictable to anyone not knowing the key. See where this is heading? Just because something looks random doesn't mean it's ...

15

Evaluating a TRNG device positively requires knowing its structure, both to evaluate the actual amount of entropy it produces, and the possibility to detect a field failure. Some devices sold as TRNG are in fact a TRNG subsystem followed by a PRNG, which produces the output of the device. In that case, if the PRNG is any good, the output of the device may ...

12

There is a very easy reason why one-time pads are not always used. It requires information sent before the encryption is set up, i.e. both the sender and the recipient need to have access to the pads themselves. That's a big pain, especially if all information was to be sent with one time pads. How would one distribute the pads themselves? There is also a ...

12

If your system already has some other unique user identifier (be it an ID, user-name, or an EmailAddress) is there any effective decrease in your security if you simply use that value as your salt? The salt in a hash actually forms two different purposes. Generally, it is acceptable for a salt to be known, so let us consider H() a hash function, S, some ...

12

Have you heard of the strange story of Dual_EC_DRBG? A random number generator suggested and endorsed by the government that exhibits some very suspicious properties. http://www.schneier.com/blog/archives/2007/11/the_strange_sto.html From that article: This is how it works: There are a bunch of constants -- fixed numbers -- in the standard used to ...

11

For some types of algorithms (or protocols) we only need non-guessable (by the attacker) bits/numbers, not reproducible non-guessable ones (like from a deterministic PRNG). In this cases, "real" random numbers are in theory (i.e. from an information-theoretic point of view, not a cryptographic one) better, since they can't be guessed (or even influenced) by ...

11

If you are doing things right, then you will get the level of randomness you are after. Translation: you are not doing things right. You use AES with CFB8 mode, which requires a random initial value. The initial value is a 16-byte string which should be generated randomly and uniformly, and a new IV shall be generated for every single encrypted message. ...

10

There are three general solutions to the non-duplicate random number problem: If you want a few numbers from a large range then pick one and reject it if it is a duplicate. If the range is large, then this won't cause too many repeated attempts. If you want a lot of numbers from a small range, then set out all the numbers in an array and shuffle the array. ...

10

1 - How feasible is it that the chip's manufacturer can predict the output of this PRNG when it passed tests from the people applying the use of this RdRand instruction in kernels? As nightcracker correctly stated, any strong cryptographic PRNG will produce a stream of numbers that pass statistical tests. However, the manufacturer has some constraints: ...

9

The bits are not independent from each other, at least within an individual song, so the pad is not truly random, thus this is not a one-time-pad. Perhaps a hash-based approach would fix this, but... ... there are a limited number of songs available, a simple attack would then be to enumerate every song (in the same format you describe) and try to decrypt a ...

8

Salts must be unique. Randomness (with a "good" random generator) is sufficient to ensure uniqueness. A per-user ID (e.g. the user login name) is not sufficient for uniqueness, because it does not capture some occurrences which do happen in practice: two users on two distinct systems (running the same software) which share the same ID (how many Joes and ...

8

Bill is right. To give you a short answer to your question: The common notion of entropy is the notion of Shannon entropy. The Shannon entropy $H(x)$ of a value $x$ that occurs with probability $Pr[x]$ is $H(x) = -log_2(Pr[x])$ you can interpret this as the uncertainty about $x$ knowing only the distribution according to which $x$ is chosen. For the case ...

8

A good block cipher should be indistinguishable from a random permutation (otherwise it is considered broken). A consequence of this is that two good block ciphers are indistinguishable from each other (with at most a doubling of the adversary's advantage). In your scenario, it means that finding a way to succeed in learning which algorithm has been used ...

8

Randomness is not a property of strings of bits (or characters of any sort). Rather it is a property of the process that generates those strings. However, it is convenient to conflate the string with the thing that produced the string, and thus to speak about strings being 'random' or 'not random'. The string '00000', for example, is random if it was the ...

7

An alternative: Client generates preliminary keypair $(t, T)$ with $T=tB$ Clients sends $T$ to server Server sends a random scalar $n$ back(alternatively choose $n = \mathrm{HMAC}(k, T)$ with secret key $k$), and assigns the public key $A = T + nB$ to the client Client uses $a = t+n$ as private and $A$ as public key. That way the server decides the ...

7

I am the designer of the random number generator that is behind the Intel RdRand instruction. How feasible is it that the chip's manufacturer can predict the output of this PRNG when it passed tests from the people applying the use of this RdRand instruction in kernels? It isn't. We cannot. It passes the tests because it is a cryptographically ...

7

Note that a block cipher is not an encryption algorithm. It's a building block. To get encryption you need a mode-of-operation that uses that block cipher. For example CBC-AES128 (and even here, it's not clear how the IV is being generated). Many encryption algorithms overtly leak their identity. Some have packaging, they put the IV in a weird place, ...

7

There is no such method. The only reliable way to "fix" a backdoored RNG is to mix its output with another, secure RNG. Specifically, let's consider a backdoor similar to that described by Becker et al. (2013), which essentially transforms the Intel TRNG into a deterministic PRNG using AES in OFB mode, with a 32-bit initial seed (occasionally reseeded) and ...

7

I would characterize the service as similar to a trusted time-stamping service. Except they do not do the time-stamping, but just provide the "key". This allows a user to decide what do to with it, such as using it as a private key to sign something, or an HMAC key, proving the signature is "not older" than the timestamp. If the signature is published to a ...

6

We want a list of $n$ distinct random-like non-negative integers less than $m$, obviously with with $n \le m$. One option is to build a cipher $C$ over the set of non-negative integers less than $m$; select a fixed random key $K$ for that cipher; and construct the desired list as $C_K(i)$ for $0 \le i \lt n$. The rationale is that a good cipher over a set, ...

6

Many of the uses of a True RNG fall into the general category of generation, without persistent storage, of a value that is different with high probability from any value determined otherwise. A value that is different with high probability from any value determined otherwise is very useful in cryptographic protocols. For example, under classic CBC ...

6

Already answered here: http://stackoverflow.com/questions/471157/is-a-subset-of-a-random-sequence-also-random , take a look at all the answers. But, saying in other words: If you have a list of random bytes, any selection you make in that list will be random as well, according to your selection criteria. Examples: if you choose every 3rd element, you'll ...

6

To expand on rossum's answer: The Fisher–Yates shuffle is actually quite a versatile algorithm. In particular, you can use it in "on-demand mode", where, whenever you need a new random number, you run one step of the algorithm (Durstenfeld version or equivalent) and output $a[i]$ (where $a$ is the array being shuffled and $i$ is the loop counter). ...

6

The difference is inconsequential in this context. If you do some "processing" (e.g. generating a RSA key pair) using a deterministic and publicly known algorithm (e.g. OpenSSL's code) where the only parameter which is not known to the attacker is a random $n$-bit seed (e.g. $n$ = 256 for 32 bytes from /dev/urandom), then there is a theoretical possibility ...

5

That looks about right. Assume we have two messages $m_1$ and $m_2$ and the corresponding signatures $(r,s_1)$ and $(r,s_2)$ generated using the same $k$ (where $r=g^k$ is thus the same for both signatures). If we could assume that $s_1 - s_2$ and $r$ were invertible modulo $p-1$, we could simply compute $$k \equiv (m_1 - m_2)(s_1 - s_2)^{-1} \mod p-1$$ ...

5

The classic way to do this is to have all parties commit to individual random values by publishing a secure hash of a suitably random-nonce-padded number. Once the commitments have been distributed, the parties open the commitments by publishing the nonce and the number. The numbers are combined in some previously agreed suitable fashion such as adding them ...

Only top voted, non community-wiki answers of a minimum length are eligible