zuallauz

119 reputation

bio	website
	location
	age
visits	member for	7 months
	seen	Jun 14 at 11:05
stats	profile views	1

	119 reputation	bio	website		visits	member for	7 months
5 badges		location			seen	Jun 14 at 11:05

summary answers questions tags badges favorites bounties reputation activity

55 Actions

suggestions reviews revisions comments badges posts accepts all

Jun 14	revised	Would this simple encrypted chat program be feasible using One Time Pads? added 274 characters in body
Jun 14	revised	Would this simple encrypted chat program be feasible using One Time Pads? added 274 characters in body
Jun 14	revised	Would this simple encrypted chat program be feasible using One Time Pads? added 184 characters in body
Jun 14	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? @fgrieu: You say it reduces the entropy per hashed character, but by how much? Do you think I should throw all the gathered entropy into a pool, combine with some other entropy (e.g. keyboard, mouse clicks, milliseconds between mouse clicks) then when I've gathered enough entropy equal to the hash bit length e.g. 256bit, then hash that string, and that can be the key?
Jun 14	comment	Would this simple encrypted chat program be feasible using One Time Pads? Why are you digging up this old post from last year to throw in more disparaging comments? Who says I'm even trying to build this anymore? I understand that crypto alone won't solve this problem. You need to actually secure the end points as well obviously (open source OS, firewalls, antivirus etc). By your argument all crypto is useless because the NSA have got malware in everything. The actual real risk these days is having your data sniffed and read over the wire by the NSA who intercept and copy all web traffic and can decrypt pretty much everything. Now stop downvoting all my old posts.
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? @fgrieu Potentially what I think we need to do is capture x,y coordinates until we have 128 bytes of unique entropy then hash it with SHA2/SHA3 hash. What do you think?
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? @fgrieu Does hashing the commas/brackets reduce entropy? Let's say I joined up 8 separate sets of coordinates, then there would be a lot of commas and brackets in that string too which aren't random. Does that matter? Also if I am hashing just a small string (the [200,330]) then hashing that, then I use that hash for my OTP key, is it theoretically possible that someone could create a rainbow table of all the possible combinations of the x,y values, then they'd have all my possible keys. Then they could get the encrypted text and try out all the keys to see if it matched?
Jun 13	revised	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? added 227 characters in body
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? I didn't downvote! I'm still processing this answer. Lets say I have X and Y coordinates of 478,702 out of a usable screen space of 1920×1080 pixels. Converting these numbers to binary gives me 001101000011011100111000 for 478 and 001101110011000000110010 for 702, which is 24bits long. In the phrack article I'm only seeing numbers with 16bits of binary code. I think he did his testing in a small portion of the screen ie 99x99 pixels? The largest number I might have is 1920 00110001001110010011001000110000 which is 32bits. Are you saying I can't use all of that and only the last 4 bits?
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? Not too worried about the practicality of the OTP, leave that for me to worry about. As far as programming is concerned it is actually the most practical to develop. Rather than something like RSA which requires a PhD in maths to understand all the notation etc.
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? My questions then would be, how does the mouse x and y only produce 2 bits of randomness per mouse movement? Also if I was joining the numbers together in a big string to consolidate 128 mouse readings before hashing, does having that many commas in the string reduce the entropy?
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? fgrieu above says to keep the comma in to separate the numbers because you might get two different coordinates 20,111 and 201,11 but they would be the same number 20111 when concatenated together. Putting the comma in keeps them separated and will result in a different hash.
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? OK sure I could include some other entropy sources later into the entropy pool, mouse clicks, time between mouse clicks, keyboard and hardware entropy. Let's say my program returns X and Y mouse coordinates 478,702. This is out of a usable screen space of 1920×1080 screen size. So you're saying concatenate them, then that would become 478,702 but if I run that through an ASCII to binary converter I actually get 7 bytes 0110100 0110111 0111000 0101100 0110111 0110000 0110010.
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? Thanks, but not sure I have enough maths knowledge to understand all the notation in the first PDF. Can you summarise it in layman's terms for me what I need to do?
Jun 13	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? For your edited answer you also mention falling back to server-generated random numbers delivered to the client over SSL. That sounds terrible as then you're sending your random numbers for your one-time pad key over a less secure transmission medium. The security of the one-time pad that used those random numbers would then only be as secure as the SSL used. So if the SSL was broken/intercepted/hijacked they could grab the random numbers and later decrypt your one-time pad. The generation of the random numbers must be done in JavaScript and stay client side as if it was a regular C++ program.
Jun 12	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? Thanks, the WebCryptoAPI you linked to looks interesting however there's no guarantee that the algorithm and entropy source the browser is using to generate the 'cryptographically secure random' bytes is actually random. In the spec it says they can only guarantee it to be psuedo-random, so not good for a OTP. Maybe you could feed bits of it into the random pool and combine it with a few other methods.
Jun 12	revised	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? I don't want to know how to do it in just JavaScript, the algorithm should be language independant.
Jun 12	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? I'm using a client side language JavaScript for a program similar to a one-time pad. From my research it mentions `/dev/random` should be suitable for uses that need very high quality randomness such as OTP or key generation. From experience though it outputs random data very slowly ie 1 byte per 30 seconds. `/dev/urandom` contains less entropy and is intended as a pseudorandom number generator suitable for most cryptographic purposes but it is not recommended for the generation of long-term cryptographic keys or OTPs. None of the OS entropy sources are available to JavaScript unfortunately.
Jun 12	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? @fgrieu, are you saying hash the x and y along with the brackets/colons so there is a distinction in the resulting hashes? What about concatenating the x and y, then multiplying that by x and then dividing that by the y? So that fixes the [200,330] and [300,220] problem (result 121412.1, 409390.9) and also the [20, 111] and [201,11] problem too (result 4084.054, 414865.64). Might run into divide by 0 errors/negative numbers though if the mouse pointer is near [0, 0]...
Jun 12	comment	Algorithm: How to use x and y mouse movement co-ordinates to generate random data? Thanks for the explanation @Thomas. Let's say I did hash of the x (200) and y (333) values concatenated together (200330) with the SHA512 algorithm. That would produce a 128 characters (128 byte string). Can I use each character of that string as key material? Especially if I am using each character to encrypt a single plain text character (similar to OTP)?