4
$\begingroup$

A lot of sites (e.g. Dirk Rijmenants') refer to 10-side dice to generate random number for . I was thinking about new ways to generate random numbers, letters and passwords. here what I got…

To generate random numbers:

  • Take out keys numbers from 0-9 from old keyboard, calculator or mobile pad and put it in a cup shake it then take one out write it on paper threw it back, shake, and take another... so on till get my numbers.

To generate random letters for OTP:

  • Take out letters key from an old keyboard put them in a cup shake it and take one out write it on paper then threw it back, shake and take another one... repeat till get my otp letters.

To generate random passwords:

  • take out letters key from black keyboard (for small letters) and another one white for capital letters, symbols/numbers keys black keys for symbols, white for numbers, then put all keys (72 keys) in a hat, shake it and take one key out write it down throw it back shake, take another one... untill I get my true random password.

Can any one confirm that way as a true random numbers, letters and passwords generator?

Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ That is a quite slow way of generating random digits/letters/signs. Its quality depends on how good you can shuffle, and if really all keys have same form, weight and so on. $\endgroup$
    – Paŭlo Ebermann
    May 10, 2013 at 18:18
  • 1
    $\begingroup$ I don't care about time here and yes they all must have the same weight as they all will come from the same keyboard, I just wonder how random they will be? $\endgroup$
    – sandy
    May 10, 2013 at 19:30
  • $\begingroup$ I don't understand. What problem are you trying to solve, that dice don't solve? Do you just want something different for the sake of being different? Or do you have some specific metric that you're trying to optimize, where you want something that's better than dice on that metric? If the latter, can you be more explicit about what that metric is? $\endgroup$
    – D.W.
    May 10, 2013 at 19:36
  • 1
    $\begingroup$ Do you just want something different for the sake of being different? sure I always that way. And yes die solve the problem but I want to invite other ways that's all... $\endgroup$
    – sandy
    May 10, 2013 at 19:44

4 Answers 4

Reset to default
5
$\begingroup$

One problem is that keyboard keys may or may not be uniform. Look at the F and J keys - they may have a little dot of plastic to identify them with your fingertips. That little dot may make them heavier or lighter than other keys, affecting how they shake up in a hat. Some keyboards, like Das Keyboard, were built with different spring actions for different keys, which might or might not affect the weight or shape of each key. And some keyboards have larger curvatures for various key tops, and those keys definitely have different mass.

The problem is that creating perfectly symmetric keys is not a design goal for keyboard designers, so without studying and measuring each keyboard, you won't have assurance that any particular keyboard is suitably random for your purpose.

They may also be just fine if you are not looking to generate thousands of passwords. If you're concerned, though, consider repurposing a device designed to generate random values. A bingo cage could be refilled with 26 hand lettered balls. Playing cards could have handwritten letters and shuffled extensively. A 100-sided dice could be repainted to match your character set, and extra values blacked out to indicate "roll again".

See also "diceware" for a way to turn 6 sided dice into passwords.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ I suppose I should add that unless your attacker has the opportunity to map out the statistical distribution of generated letters you'll probably have "random enough" passwords to suit your purpose. As far as OTP keys go, be very careful not to take out more than one letter at a time as a shortcut. If I knew you took out 5 letters each time, my search space for testing keys is reduced considerably, and the perfect security of the Vernam cipher is broken. $\endgroup$
    – John Deters
    May 13, 2013 at 21:00
4
$\begingroup$

Dice have been extremely well studied (having been used for gambling for, well, thousands of years). It is hard to beat them, for simplicity and bandwidth of random number generation, if you want to avoid use of computers for random number generation.

Dice have three advantages. First, it's pretty fast to roll dice. Second, they are familiar; people understand dice, and understand why they are random. Third, they have good randomness properties: we've been using them for centuries for gambling, and we've worked out most of the serious bugs that affect their randomness. If you want especially good quality, you can buy casino-grade dice -- the same dice used in casinos, so you have pretty good assurances that they have good randomness (casinos are relying upon them, to the tune of millions of dollars each year).

I don't think taking out letter/number keys from a keyboard and drawing them out of a hat is going to work as well, in terms of efficiency. But you could always try the experiment (try drawing 100 numbers using 10-sided dice, then by drawing number keys from a hat, and see which took longer) and report back.

Improve this answer
$\endgroup$
1
  • $\begingroup$ thanks, D.W for your answers I think you are really genius ;), and I'm sure that Five 10-side dice will be much faster, but I talk about randomness of keys in a hat, I could use it to generate random passwords too, What do you think. Is it good quality random or what. $\endgroup$
    – sandy
    May 10, 2013 at 19:29
1
$\begingroup$

The method (shake well, take out one keycap, put it back, repeat) will provide 'high' quality randomness.

All keycaps must be of the same size, weight etc.! So cheap, flat keyboards may be a better choice than curved ones ("natural", "ergonomic" ...).

You can also use a cotton bag, large enough to stretch out your fingers while inside. if you insist on cups and hats, use the bag just to store/transport your TRNG.

To test, make at least a few thousend draws. With dice, a few hundred rolls per dice will show all but (very) small imperfections (cheap ones from a toy store; casino grade dice need more rolls to test).

Using the black&white approach using A-Z, a-z, 0-9, dot (.) and dash (-) gives you 6 bit per single draw. Using dice, 6 bit require two rolls off a dice plus a third roll to decide letter case or '0/.', '1/-'. 6x6 matrix, roll the row, then the column, and, if applicable [a-z01], the case ("uppercase" 0 dot, 1 dash).

Dice are available almost everywhere. Salvaging keyboards takes time to find suitable ones in the first place.

Improve this answer
$\endgroup$
0
$\begingroup$

No, it will not produce quality random numbers, in the same way that shuffling a deck of cards will not produce a randomly shuffled deck. If two keys are next to one another when you start shaking, they will quite likely be next to one another when you stop shaking.

If I know one value from your random number generator, I can learn information about other values from your random number generator, whether they come before or after.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.