Questions tagged [randomness]

Usage of randomness (i.e. non-predictable data, usually in the form of bits or numbers) for cryptographic purposes.

44 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
164 views

Reusing same source for single-source randomness extractor

Let $ext$ be a single-source randomness extractor which takes a $d$-bit seed and a $n$-bit source as input and produces a $m$-bit output. Suppose we have a source $X$ with min-entropy $k$. Is it ...
4
votes
0answers
132 views

Use of randomness in an Elgamal like encryption

Suppose I have the following encryption scheme: for a message $m\in\mathbb{F}_p^*$, I generate the ciphertext = $(g^r,f^mh^r)$ where $g$ is the generator of a cyclic group $G$ of unknown order $n$ and ...
4
votes
0answers
209 views

Feasible way to check n-dimensional equidistribution of PRNGs

I am currently gathering some test methods and test suites for random number generator qualities, and am a bit stuck at finding something feasible to test for n-dimensional equidistribution. As input ...
3
votes
1answer
169 views

Use of scrambler LFSR for randomness extraction of semi-random source

I am using a linear feedback shift register (LFSR) in a scrambler configuration as a randomness extractor for a weakly random source. This source is semi-random (aka. Santha-Vazirani source): the bits ...
3
votes
0answers
61 views

Computational Randomized Encoding in the hybrid proof

A computational randomized encoding scheme $(\textrm{RE.Encode}, \textrm{RE.Decode})$ works as follows: $\textrm{RE.Encode}(1^\lambda, C, x, r)$: takes as input the security parameter $\lambda$ in ...
2
votes
0answers
52 views

Fisher Yates on "faulted" random number generator cryptanalysis

For the sake of curiosity and fun, i have implemented a C# program that operate as deck dealer on 40 cards deck (following the Fisher Yates shuffeling algorithm https://en.wikipedia.org/wiki/Fisher%E2%...
2
votes
0answers
448 views

Can Verifiable Random Functions be used to pick a random node from a pool?

Let's say that I have a decentralized system and I have a list of nodes published on a public log like a blockchain. I want a node A to be able to connect to ...
2
votes
0answers
71 views

Is the number still a CSPRN if we only allow an interval from a CSPRNG?

tr -dc 0-9 < /dev/urandom | fold -w 3 | awk '$0>=100 && $0<=200' What this line does: /dev/urandom (Linux) is proven to be a CSPRNG, that is ...
2
votes
0answers
108 views

Special random distribution algorithm

I am implementing ring signatures as a part of an authorization system. Since the number of users could get high enough to make computation on end-user devices infeasible, I am thinking of "...
2
votes
1answer
112 views

How to verify the claim of entropy available made by Linux 4.5?

The Linux kernel has an entropy source and it estimates its amount of bits in the device /proc/sys/kernel/random/entropy_avail. How can I verify that this number ...
1
vote
0answers
36 views

Sentinel ("trick") values for lattice attack on DSA with biased k (MSB)

I'm studying lattice attack using this sage script. There are 2 options in script: LSB and MSB. The most interesting option for me is MSB. It recovers private key with less then 100 signatures ...
1
vote
0answers
73 views

How does a pseudorandom generator produce a similar distribution to $U_{n}$?

According to Wikipedia, a function ${\displaystyle G:\{0,1\}^{\ell }\to \{0,1\}^{n}}$ with ${\displaystyle \ell < n}$ is a pseudorandom generator against $\mathcal {A}$ with bias $\epsilon$ if, ...
1
vote
0answers
64 views

Nth term for Linear Congruence Generators

We can get the N+1th term for a Linear Congruence Generator like this: x[n+1] = A * x[n] (mod m) by raising the A to the exponent of n like this: ...
1
vote
0answers
64 views

Min Entropy per Bit for Trevisan's Extractor/or An Extractor

We know that: trevisan's extractor based on min entropy of the relative system. For trevisan extractor, we need source, seed, min entropy value per bit and error rate for per bit I have the code for ...
1
vote
0answers
32 views

NIST STS randomness testing inconsistent results

I have generated the nine datasets according to this document for AES-128 and testing these for randomness using NIST STS. However, the results are inconsistent. Sometimes there appear a * in the ...
1
vote
1answer
99 views

What is a "set synchronized CSPRNG"?

I'm looking to implement a performant revocation method for JWTs. I'm reading a paper, in which the following section's second paragraph states: If we use the client hashing approach described ...
1
vote
0answers
81 views

libgcrypt and rdrand usage

For some reasons, I was looking into libgcrypt source code and found this. If I understand this correctly, while asking to use /dev/random for some bytes, it actually checks first if rdrand is ...
1
vote
0answers
91 views

Would the result of encrypting weak random data via AES-128 with a CSPRNG-generated key be considered strong/secure random data?

I am trying to understand the security implications of using a well known block (or stream but in this example block) cipher like AES-128 to produce pseudo-random data. My specific question is would ...
1
vote
0answers
106 views

Why does a "never-repeating" nonce limit a key to safely encrypt only a single block?

This questions comes from a section outlined in RFC 5297 on SIV-AES. The paragraph in particular outlines the idea of a never repeating nonce vs an "almost always" non-repeating nonce. If the nonce ...
1
vote
0answers
77 views

Randomness Test of Permuted Sequence

As we can generate a permuted sequence using KEY in KSA (Key Scheduling Algo) of RC4. Is there any way to check the randomness of the permuted sequence? Let say I created 100 different permuted ...
1
vote
0answers
73 views

What is fixed randomness and unfixed randomness?

I have found these notions recently in an article. What is fixed randomness ? What is unfixed randomness ? Link of the article : http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.431.9034&...
1
vote
0answers
165 views

How Are Linear Congruential Generator Multipliers Chosen?

There are several numbers that keep coming up when looking at certain random number generators, for example 6364136223846793005 is used in newer pcg-family algorithms and seems to draw it from ...
1
vote
0answers
107 views

Is there an algorithm or protocol that allows to securely generate random shuffles when two parties are not colluding without a sever side seed?

I am building an app that pits one party against another party in a gambling transaction – both parties have competing interests and have an incentive not to cheat the other party. I am looking for a ...
1
vote
0answers
72 views

Beginners question about revealing randomness in probabilistic asymmetric encryption

I am encrypting "1" with probabilistic encryption with a foreign public key (I don't have the private key for it) which results in an encrypted file e. Can I prove to a third party, that e contains ...
1
vote
0answers
68 views

RIsk mitigation: block cypher vs xor

It sort of looks like to me that there is a kind of risk mitigation in the architecture of block cyphers vs the xor cypher. In XOR, the risk is entirely in the random number generator. The XOR ...
1
vote
0answers
53 views

Fuzzy Extractor: Order of elements in set

Does order of elements in two sets matters to authenticate using Fuzzy Extractor? Using extractor as proposed in https://www.cs.bu.edu/~reyzin/fuzzy.html it seems the set difference is zero for this ...
1
vote
0answers
528 views

Relationship between "Entropy" and "Security" in crypto functions

There is a lot of confusion between "entropy" and "security" of a cryptographic function. I like to visualize it as the entropy being the water, and the crypto function being a glass. So for ...
1
vote
0answers
49 views

Does RSA_PRBG security depend on keeping seed secret?

The HAC provides a PRBG using RSA (Chapter 5 p.185): It appears the seed must be kept secret if $e$ is a well known value. If $e$ is uniformly distributed between 1 and $\phi$, then the seed does not ...
1
vote
0answers
221 views

PHP predicting array_rand

Given the following PHP code (assuming PHP 5.6.x): ...
1
vote
0answers
98 views

To prove $r_2$ is a uniformly at random value in $Z_n$, where $r_2=r_1 . m$

$m$ is arbitrary value in $Z_n$, where n is RSA modulo. Then we do: $r_2=r_1 . m (modn)$, where $r_1$ is a random value such that $r_1\in Z^*_n$. ** Question(1): is $r_2$ a uniformly at random ...
0
votes
0answers
48 views

Cryptographic Random Beacon VS Random Oracle

Let's start with what I mean by cryptographic random beacon (RB). A RB is a protocol among some parties who generate a random value all together such that: these parties do not trust each other the ...
0
votes
1answer
73 views

Cryptographically correct way to roll a giveaway winner

I'm looking to create a fair selection of a giveaway winner, but I am versed enough in cryptography theory to determine if the below would hold up to public scrutiny if published on github. The reason ...
0
votes
0answers
38 views

Can disjoint distributions be Computationally indistinguishable?

As mentioned in these notes definition 2 We say that $\{Xn\}_n$ and $\{Yn\}_n$ are computationally indistinguishable if, for all $\mathsf{nuPPT}$ $D$, there exists a negligible function $ε$ such that ...
0
votes
0answers
35 views

Alter signature post signing without the private key

There a plethora of signature scheme's but I am wondering if there are scheme's with the following properties: Given that you know the message, alter the signature with the public key in such a way ...
0
votes
0answers
56 views

How do I retrieve a number which has been multiplied with a random number?

I have a 1024-bit number $n$ obtained by multiplying two 512-bit randomly generated prime numbers $p$ and $q$. Then there's $\phi = (p-1)(q-1)$, which is another 1024-bit number. I do not have $\phi$ ...
0
votes
0answers
43 views

Security analysis of encrypting a matrix after homomorphic encryption by the random mask

Problem Definition Alice has two private matrices $M_A$ ($N*M$), $M_a$, where $M_a$ is the binary matrix of $M_A$ Bob has a private matrix $M_B$($N*M$) Alice and Bob are semi-honest server and ...
0
votes
0answers
134 views

Randomness Testing of Block Ciphers with 256-bit Block/ Key length

NIST explained the process of "Randomness Testing of the AES Candidate Algorithms" in the document. The document explains the generation of 9 datasets for AES candidates with 128-bit block ...
0
votes
1answer
89 views

Explaining the reason of radically more accuracy while using different set of hash functions instead of same set of hash functions on some operations

So I am looking for an explanation of an experiment. In this experiment, I took a set of k hash functions. Say the total number of data points I am working on is d. Call an algorithm A which used that ...
0
votes
0answers
59 views

RNG randomization strength for PRF seed

Consider a use case that requires the creation of multiple asymmetric key pairs. There are two options for generating random seeds for a PRF: Use a software based RNG and generate a new seed for each ...
0
votes
0answers
61 views

What is the probability that a random function is invertible?

Having a random function - $R\in{}\mathcal{R}$ s.t. $R:\{0,1\}^n\rightarrow{}\{0,1\}^n$. What is the probability that $R$ is invertible? I know calculating it suppose to be straight forward, but I'...
0
votes
0answers
120 views

Crack LCG given 2 output values only

I want to try to break an LCG generator just as programming practice task. I found similar issue at Cracking a linear congruential generator. Assume that m is given. The answer to the link above ...
0
votes
0answers
160 views

Prove that a given signature scheme is secure under random message attacks

This is a follow up to my previous question. Consider the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : ...
0
votes
0answers
83 views

Difference between public coin and common coin?

What is the difference between public coin and a common coin? I often see both appearing in the literature, but I cannot explain myself, whether they are the same concept or not.
0
votes
0answers
73 views

Lsb as hard core predicate in a sign-hash scheme

Given a random oracle and a deterministic signature scheme. Is the following $hc(x)$ an hardcore predicate of $H(SIG_k(x))$ ? $$hc(x)=lsb(H(SIG_k(x)))$$ How would I get to think about this? I saw a ...