158 reputation
7
bio website
location
age
visits member for 1 year, 10 months
seen Mar 8 at 10:36

Jun
13
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
I didn't downvote! I'm still processing this answer. Lets say I have X and Y coordinates of 478,702 out of a usable screen space of 1920×1080 pixels. Converting these numbers to binary gives me 001101000011011100111000 for 478 and 001101110011000000110010 for 702, which is 24bits long. In the phrack article I'm only seeing numbers with 16bits of binary code. I think he did his testing in a small portion of the screen ie 99x99 pixels? The largest number I might have is 1920 00110001001110010011001000110000 which is 32bits. Are you saying I can't use all of that and only the last 4 bits?
Jun
13
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
Not too worried about the practicality of the OTP, leave that for me to worry about. As far as programming is concerned it is actually the most practical to develop. Rather than something like RSA which requires a PhD in maths to understand all the notation etc.
Jun
13
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
My questions then would be, how does the mouse x and y only produce 2 bits of randomness per mouse movement? Also if I was joining the numbers together in a big string to consolidate 128 mouse readings before hashing, does having that many commas in the string reduce the entropy?
Jun
13
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
fgrieu above says to keep the comma in to separate the numbers because you might get two different coordinates 20,111 and 201,11 but they would be the same number 20111 when concatenated together. Putting the comma in keeps them separated and will result in a different hash.
Jun
13
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
OK sure I could include some other entropy sources later into the entropy pool, mouse clicks, time between mouse clicks, keyboard and hardware entropy. Let's say my program returns X and Y mouse coordinates 478,702. This is out of a usable screen space of 1920×1080 screen size. So you're saying concatenate them, then that would become 478,702 but if I run that through an ASCII to binary converter I actually get 7 bytes 0110100 0110111 0111000 0101100 0110111 0110000 0110010.
Jun
13
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
Thanks, but not sure I have enough maths knowledge to understand all the notation in the first PDF. Can you summarise it in layman's terms for me what I need to do?
Jun
13
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
For your edited answer you also mention falling back to server-generated random numbers delivered to the client over SSL. That sounds terrible as then you're sending your random numbers for your one-time pad key over a less secure transmission medium. The security of the one-time pad that used those random numbers would then only be as secure as the SSL used. So if the SSL was broken/intercepted/hijacked they could grab the random numbers and later decrypt your one-time pad. The generation of the random numbers must be done in JavaScript and stay client side as if it was a regular C++ program.
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
Thanks, the WebCryptoAPI you linked to looks interesting however there's no guarantee that the algorithm and entropy source the browser is using to generate the 'cryptographically secure random' bytes is actually random. In the spec it says they can only guarantee it to be psuedo-random, so not good for a OTP. Maybe you could feed bits of it into the random pool and combine it with a few other methods.
Jun
12
revised Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
I don't want to know how to do it in just JavaScript, the algorithm should be language independant.
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
I'm using a client side language JavaScript for a program similar to a one-time pad. From my research it mentions /dev/random should be suitable for uses that need very high quality randomness such as OTP or key generation. From experience though it outputs random data very slowly ie 1 byte per 30 seconds. /dev/urandom contains less entropy and is intended as a pseudorandom number generator suitable for most cryptographic purposes but it is not recommended for the generation of long-term cryptographic keys or OTPs. None of the OS entropy sources are available to JavaScript unfortunately.
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
@fgrieu, are you saying hash the x and y along with the brackets/colons so there is a distinction in the resulting hashes? What about concatenating the x and y, then multiplying that by x and then dividing that by the y? So that fixes the [200,330] and [300,220] problem (result 121412.1, 409390.9) and also the [20, 111] and [201,11] problem too (result 4084.054, 414865.64). Might run into divide by 0 errors/negative numbers though if the mouse pointer is near [0, 0]...
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
Thanks for the explanation @Thomas. Let's say I did hash of the x (200) and y (333) values concatenated together (200330) with the SHA512 algorithm. That would produce a 128 characters (128 byte string). Can I use each character of that string as key material? Especially if I am using each character to encrypt a single plain text character (similar to OTP)?
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
That's a good point @fgrieu thanks. So hashing "200330" and "300220" will produce a different hash.
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
@CodesInChaos, why put them all into a crypto hash?
Jun
12
revised Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
added 203 characters in body
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
Great, thanks @hunter. I guess I was trying to say that just taking the X coordinates by themselves isn't particularly random as they could be moving the mouse in one direction (typical use) so you'd get a string of increasing numbers e.g. 123 124 127 129 etc but combining it with the Y coordinates as well you get a more unique number, no? If so what would be the correct way to combine the two numbers for maximum randomness?
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
The language I am doing this in does not have access to the raw operating system's PSRNG streams. Also I need actual random not psuedo random.
Jun
12
asked Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
Dec
7
accepted Does a playlist of songs or movies mixed together contain enough random enough for OTP key material?
Dec
5
comment How can I validate a hashed password if all I have is another hash?
You can try out this solution here which does what you want I think. Also it uses a nonce to prevent replay attacks.