Questions tagged [randomness]
Usage of randomness (i.e. non-predictable data, usually in the form of bits or numbers) for cryptographic purposes.
540
questions
1
vote
2
answers
34
views
The security of using a digital signature scheme twice with randomness
Suppose $\Pi=(Gen,Sign,Vrfy)$ is a secure signature scheme, is the following signature scheme $\Pi'$ secure?
$Gen'$: The same as $Gen$, output public-private key pair $pk,sk$ on input $1^n$
$Sign'$: ...
1
vote
0
answers
141
views
If G is a PRG, is G' necessarily a PRG?
Given:
A function $$G: \{0,1\}^{3n} \to \{0,1\}^{6n}$$ which is known to be a secure Pseudorandom Generator (PRG).
A derived function $$G'(x_1 \| x_2) = G_b(x_1\|0^n\|x_2), \text{ where } x_1, x_2 \...
- 11
0
votes
0
answers
49
views
RSA random key generation [duplicate]
How RSA keys are tested for primality if they are random generated? I imagine this could be time consuming task.
2
votes
2
answers
167
views
A question about "attacks on MAC key space"
At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence
For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects $1+2^{(t-n)...
- 21
1
vote
1
answer
96
views
Can this algorithm be called a RNG?
So I developed this algorithm as RNG, although it looks random to me, I wanted to know the opinion of more experienced persons in the topic.
...
- 13
0
votes
2
answers
131
views
From Entropy's perspective how Encryption affects a Message?
How Ciphers, specifically, Substitution Ciphers and Transposition Ciphers manipulate the Entropy of Plaintext w/wo the aid of Entropy Source?
Reversely, how Decryption manipulates the entropy of ...
- 153
1
vote
0
answers
71
views
Two-party randomness for KEM
As indicated in an earlier Q / A, KEM's do not necessarily directly encrypt a pre-generated random value. However, it is clear that some KEM's do actually do this, with RSA-KEM being an obvious ...
- 91.7k
2
votes
1
answer
57
views
NIST random number tests report
I am using the NIST test suite to test random binary numbers. when I tried it for data.pi, the generated report has some items that can not be interpreted.
for example, the coeffecients named C0~C10. ...
- 55
4
votes
2
answers
765
views
What are the state-of-the-art TRNGs today?
How fast are the fastest ones? Which ones have the most entropy? Which ones are the most practical ones?
I tried looking for answers on Wikipedia and also, I tried reading papers, but I am couldn’t ...
4
votes
2
answers
193
views
Is it valid to transform the tested sample file and re-test, rather than invent additional randomness tests?
I'm enhancing the venerable ent randomness test suite. And I came across this idea in On Independence and Sensitivity of Statistical Randomness Tests.
"To ...
- 15.2k
2
votes
0
answers
42
views
Deterministically secure PRG from deterministically secure OWF
Consider the construction of "A Pseudorandom Generator from any One-way Function" [HILL99] in Hastad et al.
One way to proof pseudorandomness of this construction is by contradiction.
That ...
- 161
0
votes
0
answers
45
views
Does randomization make a big difference in the output of the BKZ algorithm?
We all know that block Korkine-Zolotarev (BKZ) algorithm is essentially a deterministic lattice reduction algorithm. However, in the actual implementation, the BKZ algorithm contains some ...
- 147
1
vote
0
answers
94
views
Can someone give a comprehensive guide on how to run NIST SP 800 90B entropy assessment c code in windows? [closed]
I am trying to run the github code in windows 11. I don't know what all I need to install in my laptop to run the C++ code. It would be a great help if someone can point out the steps to run the code.
- 11
3
votes
2
answers
104
views
A HRNG that is NIST 800-90 compliant is not suitable for use for OTP generation right?
A HRNG that is NIST 800-90 compliant must use a DRBG in some way regardless of whether it adheres to a RBG1, RBG2 RBG3(XOR), or RBG3(RS) construction. This violates the requirement that the OTP is ...
- 65
3
votes
2
answers
596
views
Why does NIST SP 800-90C RBG3 construction require XOR or reseeding a DRBG with a physical entropy source to produce full entropy?
NIST 800-90C defines 3 classes of random bit generation (RBG) constructions: RBG1, RBG2 and RBG3. All constructions must include a DRBG from NIST SP 800-90A. The particular construction in question is ...
- 65
0
votes
1
answer
105
views
If we supply a random uuid4 hashed salt to Hashid, will it be considered secure?
Ideally, Hashids -: https://pypi.org/project/hashID/ are considered insecure and it is recommended that we should not use them for any sensitive functions. Though, is a HashId considered secure if we ...
0
votes
0
answers
68
views
Why is decryption algorithm usyally deterministic?
For security against Chosen Plaintext Attack (CPA), we need randomized algorithms for encryption. But in some schemes (maybe almost all of them) take decryption algorithm deterministic. This procedure ...
- 363
0
votes
1
answer
52
views
Does quantum-sourced randomness allow a potential random oracle instantiation?
My question is essentially the same as this one.
The random oracle is a black box that does two things.
Maintain a lookup table for any query that has already been asked.
For all new queries, toss a ...
- 693
2
votes
2
answers
222
views
Good entropy from entropy test (90B) but still fail NIST800-22
I designed my TRNG with FPGA. My TRNG has a good entropy performance with a value of 0.99x over several test times. But for the NIST800-22, during several run times, sometimes my sequence passes all ...
- 23
0
votes
1
answer
79
views
Are Universally Unique Lexicographically Sortable Identifiers (ULIDs) safe to use as a session id?
The spec ( https://github.com/ulid/spec which is not a real standard ) explains that there are 80 random bits in an ULID. UUIDv4 is better from a security aspect, as it has 122 bits for randomness. ...
- 113
1
vote
1
answer
60
views
Threshold Paillier encryption key generation time
I have used the threshold version of Paillier encryption without a trusted dealer in an application. I have tested the key generation phase with different security key sizes such as 80, 512, 1024, and ...
- 11
2
votes
1
answer
85
views
Is there any secure deterministic two-party computation protocol?
The notion of security considered here is privacy. Is there a secure two-party protocol does not rely on randomness at all when considering passive adversaries (or active adversaries)? If the answer ...
- 21
1
vote
1
answer
72
views
Can the last n bitcoin blocks (including transactions) be reliable enough to be used as a seed for a PRNG or an input to a crypto hash-function?
Suggested by u/HolgerBier on reddit
Is it unpredictable enough or too difficult to manipulate (as in more than a few hundred million USD) to have a sequence of blocks?
1
vote
0
answers
51
views
What are some ways to produce a pre-determined sequence of a large number of dice rolls? [closed]
What are some ways to produce a pre-determined sequence of a large number of dice rolls (on the order of 100-1000 times) using biased dice or a biased human roller given the constraints that multiple ...
1
vote
1
answer
69
views
Does game-theoretical fairness work in when the goal of one party is randomness
When we take the coin flip in Blum's algorithm in "Coin flipping by telephone a protocol for solving impossible problems", where Alice and Bob both want ownership over the same car, then one ...
- 13
0
votes
1
answer
127
views
Is a pseudorandom function (PRF) also a one-way function (OWF)? If yes, how can we proof that a PRF $f_k$ is a OWF? If no, what is the closest work?
Let $f_k$ be a PRF. We claim that $f_k$ is a OWF. PROOF let $f_k$ is not a OWF, there exists a $PPT$ algorithm $A$ that can invert $f_k$ with non-negligible advantage. Even if we know the input $x$ ...
- 63
2
votes
1
answer
279
views
Walsh-Hadamard transform in randomness testing
I am working on using the Hadamard transform as a way to map randomly generated values and then apply statistical tests as defined by Nist or other institutions. One resource online I found ...
- 45
1
vote
1
answer
72
views
Frequency Monobits Test
As detailed in the paper Statistical test suite for random and pseudorandom number generators for cryptographic applications by NIST, the first test is given as a basic significance test, it uses a ...
- 45
1
vote
3
answers
151
views
Why cant you use randomness to seed more randomness?
If I have 256 bits of handwavium "perfectly random data" and I hash these 256 bits of data with a secure hash function (possibly SHA-256).
Could the resulting hash be considered "...
0
votes
1
answer
54
views
Runs and Autocorrelation test
I have the book "Handbook of applied cryptography". In there we have example for random tests.
I have bits sequence ...
7
votes
8
answers
2k
views
How to generate random numbers within a range (0,n) from random bits?
What is a good method to generate random numbers between 0 and n from random bits?
For example, I have a one million random bits generated according to NIST SP 800 90 publications. Now I need to ...
- 2,397
6
votes
1
answer
337
views
How can 4 users generate a provable fair random number?
The past few weeks I have been trying to solve a difficult problem.
I have asked some cryptography experts but unfortunately they had no clue on how to solve the problem.
The situation is as follows, ...
- 61
2
votes
2
answers
207
views
A problem about matrix
I have an idea but I don't know if it will work. For the appropriate $p$ it is easy to find $n$ linearly independent $x_i$. Then we compute the inner product between the $x_i$. I think the information ...
- 147
4
votes
2
answers
190
views
Paillier cryptosystem break with random number
In the Paillier cryptosystem we choose $n=p\,q$ where $p$ and $q$ are primes, $g=n+1$, $\lambda=\phi(n)$, $\mu=\lambda^{-1}\bmod n$.
The public key is: $(n,g)$.
The private key is: $(\lambda,\mu)$.
...
5
votes
2
answers
410
views
DDH hardness with shared public parameters
DDH is believed hard for subgroup of $ℤ^*_p$ with order $q=(p-1)/2$ when $p$ is a safe prime chosen randomly.
What if $p$ isn't random: When parameters are shared, $p$ mightn't have been chosen ...
- 83
3
votes
3
answers
462
views
How bad are human-generated random numbers really (One Time Pad)?
This is a pretty open question, so I'm mostly looking for gut reactions from experts more educated than I.
Given these assumptions which are easy to verify with a quick Google search:
One Time Pads ...
- 159
1
vote
0
answers
45
views
ECDSA security proof in random oracle [duplicate]
I need to know if there is a security proof for ECDSA in the Random Oracle model?
- 51
17
votes
5
answers
4k
views
Examples of frauds discovered because someone tried to mimic a random sequence [closed]
[Moderator note: this question now lives there]
So, I'm preparing a talk about the well known fact that humans are bad at the task of generating uniformly random sequences of numbers when asked to do ...
- 278
0
votes
2
answers
69
views
Does processing a trully random seed though a non-cryptographic PRNG will result in a unpredictable stream?
I have been studying C/C++ and I read that if one wants unpredictable random data in a program, it is needed that a random generation function be supplied with truly and unpredictable random data (as ...
- 877
2
votes
0
answers
30
views
Safe p-value for NIST randomness test with small sample size
In this journal paper related to physically unclonable function (PUF) [1], the authors used NIST 800-22 test to check if the bitstreams generated by their PUFs are random, which is described as ...
- 121
1
vote
1
answer
206
views
Can I use a cryptographic hash function such as sha256 for Randomness Extraction [duplicate]
I want to transform a semi random input to a shorter, uniformly random bit string. Assuming there is enough entropy in the semi random input, can I use a collision resistant hash function to extract ...
1
vote
0
answers
127
views
Probability of getting a collision using chosen plaintext attacks
For university I am doing a piece of coursework right now. This question is focusing on CPA and collisions using CPA.
Question:
I have attempted to answer part 3, but am not very confident in the ...
- 77
-1
votes
2
answers
83
views
Do all numbers have all the same chances to be returned using a CSPRNG?
Given a range of numbers, e.g. [1, 2^256], does each number have the same chances to be picked by a CSPRNG, which are 1 in 2^256?
My concern is that truly random number generators do have this feature,...
- 95
4
votes
3
answers
1k
views
Weak physical random number generator/source - what is this?
Why physical random number source can be weak? I see two kinds of problems:
it is hard to control it and make it resistant to some unwanted bias, but also deliberate attacks,
it has normal ...
- 1,211
1
vote
1
answer
204
views
Where can I find a comprehensive guide to running the NIST SP800-90B_EntropyAssessment?
I am already using the 2 they suggest :
https://github.com/usnistgov/SP800-90B_EntropyAssessment https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf
but, here is where I run into ...
2
votes
1
answer
119
views
exact meaning of ntup in dieharder tests
I'm working with the dieharder package to test a PRNG, but I don't quite understand the ntup parameter.
I get that the ntuple should be a set of consecutive bits. ...
- 21
0
votes
1
answer
176
views
Secure Random number generator
I am trying to implement a random number generator (which should be cryptographically secure), I am thinking of combining multiple LFSRs, is it a good choice?
I've also heard I can create RNGs from ...
- 33
1
vote
1
answer
134
views
Indistinguishability obfuscation and PRFs
Consider a family of pseudorandom functions $F$, each member $f_k$ of this family is indexed by a key $k$. It is true, due to a result by Barak et al, that black box obfuscation is not possible for a ...
- 357
0
votes
1
answer
159
views
Seed of pseudo-random number generators
How is the seed of PRNGs generated? They can't be hardcoded I am guessing.
- 33
1
vote
1
answer
2k
views
Should we really rely on "Cryptographically Secure Pseudo-Random Number Generators" (CSPRNG) alone to guarantee secure random output?
Would it be over-engineering to for example hash the random numbers a random amount of times too, for instance when using the CSPRNG in client-side JavaScript? (assuming this is not the strongest ...
- 293