Questions tagged [randomness]

Usage of randomness (i.e. non-predictable data, usually in the form of bits or numbers) for cryptographic purposes.

Filter by
Sorted by
Tagged with
5
votes
2answers
348 views

What's wrong with NIST SP 800-90B?

NIST SP 800-90B offers various tests for estimating entropy. They also offer an implementation of these tests. With their program called ea_iid, estimating ...
5
votes
3answers
3k views

Why is the output of a True Random Number Generator (TRNG) insecure after it has been compressed?

I came across the following statement regarding true random number generators (TRNG): A “P1 medium” [AIS31] true random number generator (TRNG) may not be directly used due to cryptographic reasons. ...
3
votes
2answers
477 views

Distribution of the Difference of Uniformly Random Elements

In the search to decision reduction of 'On Ideal Lattices and Learning with Errors over Rings', the authors implicitly use the fact that the difference of distinct, uniformly random elements of a (...
0
votes
0answers
134 views

Randomness Testing of Block Ciphers with 256-bit Block/ Key length

NIST explained the process of "Randomness Testing of the AES Candidate Algorithms" in the document. The document explains the generation of 9 datasets for AES candidates with 128-bit block ...
1
vote
1answer
81 views

How can we define $\epsilon$-differential privacy for non-deterministic algorithms?

We know that non-trival deterministic algorithm does not guarantee privacy and randomization is essential for privacy (pp.16 in [Dwork and Roth 2014] ). The well-known $\epsilon$-diferential privacy ...
0
votes
1answer
89 views

Explaining the reason of radically more accuracy while using different set of hash functions instead of same set of hash functions on some operations

So I am looking for an explanation of an experiment. In this experiment, I took a set of k hash functions. Say the total number of data points I am working on is d. Call an algorithm A which used that ...
7
votes
1answer
88 views

What quality of randomness is needed for randomized side channel countermeasures?

Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES ...
3
votes
1answer
117 views

randomness of encrypt

In the paper "Efficient Encryption from Random Quasi-Cyclic Codes" of Gaborit et al. p.14, I read "Encrypt$(pk=(G,Q,s),\mu,\theta)$: uses randomness $\theta$ to generate $\epsilon \...
0
votes
0answers
59 views

RNG randomization strength for PRF seed

Consider a use case that requires the creation of multiple asymmetric key pairs. There are two options for generating random seeds for a PRF: Use a software based RNG and generate a new seed for each ...
1
vote
1answer
426 views

Is it possible to create a 128-bit UUID from a weak entropy source?

I am looking at a seemingly popular piece of JavaScript code to generate a UUID which is supposed to be a 128-bit number: ...
2
votes
1answer
256 views

Using SHA2 as random number generator?

I need to generate secure pseudorandom numbers in an embedded system. Instead of having to port some RNG library, could I just use an existing SHA2 function as a random number generator (n-th random ...
0
votes
0answers
61 views

What is the probability that a random function is invertible?

Having a random function - $R\in{}\mathcal{R}$ s.t. $R:\{0,1\}^n\rightarrow{}\{0,1\}^n$. What is the probability that $R$ is invertible? I know calculating it suppose to be straight forward, but I'...
3
votes
1answer
82 views

Hide Randomness in Ciphertext

Ciphertext has the property to appear random. As a matter of fact, randomness is the first test, an encryption algorithm must pass. However, there are various setups, which monitor the incoming/ ...
1
vote
2answers
123 views

Extracting Randomness from a Poisson Distribution

I'm working on a quantum random number generator based on the shot noise of CMOS camera sensor. Shot noise in an image is caused by the variance of the number of photons hitting the sensor per unit of ...
1
vote
1answer
116 views

random mask reversible after homomorphic encryption

I would like to know if this process is feasible under homomorphic encryption, ideally under paillier or any other additive scheme Apply a mask X to obfuscate a message A ie. Am = A (op) X where (op)...
1
vote
1answer
60 views

Can hashes be used to generate larger random numbers?

As far as I understand a hash transforms data into a fixed length representation. For example, a random function returns 8-byte numbers and a hash function has a block size of 32-bytes. If I now ...
1
vote
1answer
32 views

Does splitting random data reduce its security?

Let's say I've got some securely-generated random data I want to encode as words, 32 bits of it. My wordlist is 2048 words, so each word encodes 11 bits of information. I write a routine to pack ...
18
votes
2answers
4k views

A website that identifies an RNG from its output

This happened during a discussion of RNG entropy, and the difficulty of verifying the level of entropy in a long sequence of bits (e.g. a private key.) A colleague of mine told me about a website ...
1
vote
2answers
519 views

Why is Math.floor(Math.random()*9000) not secure in JavaScript?

I heard that one can predict the output from Math.Random() of JavaScript, but another day I had an idea to combine Math.random() ...
1
vote
1answer
99 views

What is a "set synchronized CSPRNG"?

I'm looking to implement a performant revocation method for JWTs. I'm reading a paper, in which the following section's second paragraph states: If we use the client hashing approach described ...
2
votes
1answer
451 views

Dieharder input file with a sequence of only binary numbers

I have a RNG producing sequences of binary numbers, ad I would like to run Dieharder test using them as an ascii txt input file. However I haven't been able to do it properly. Should I use a header ...
1
vote
0answers
81 views

libgcrypt and rdrand usage

For some reasons, I was looking into libgcrypt source code and found this. If I understand this correctly, while asking to use /dev/random for some bytes, it actually checks first if rdrand is ...
2
votes
2answers
166 views

Mathematical definition of deterministic and non-deterministic random bit generators

Can anyone give the mathematical definition of deterministic and non-deterministic random bit generator? Providing a reference will also be very helpful.
1
vote
0answers
91 views

Would the result of encrypting weak random data via AES-128 with a CSPRNG-generated key be considered strong/secure random data?

I am trying to understand the security implications of using a well known block (or stream but in this example block) cipher like AES-128 to produce pseudo-random data. My specific question is would ...
2
votes
2answers
123 views

Doesn't d6 to binary for 256-bit bitcoin private key generation produce biased results?

If the mapping table looks like: 1: 000 2: 001 3: 010 4: 011 5: 100 6: 101 Then you are guaranteed that your key will never have a chain of 4 or more 1s, much fewer chains of 3 ones than would ...
9
votes
3answers
883 views

Perfect shuffle possible with limited raw entropy?

I am trying to shuffle a standard 52-card deck in a perfect way (every outcome should be possible at an equal chance). I am not, at this point, concerned with cryptanalysis attacks against it. I have ...
1
vote
2answers
405 views

The importance of randomness in the creation of a key

Why does it matter what kind of random number generation is used during key generation? E.g. this answer states ...
1
vote
0answers
106 views

Why does a "never-repeating" nonce limit a key to safely encrypt only a single block?

This questions comes from a section outlined in RFC 5297 on SIV-AES. The paragraph in particular outlines the idea of a never repeating nonce vs an "almost always" non-repeating nonce. If the nonce ...
0
votes
0answers
120 views

Crack LCG given 2 output values only

I want to try to break an LCG generator just as programming practice task. I found similar issue at Cracking a linear congruential generator. Assume that m is given. The answer to the link above ...
1
vote
0answers
52 views

OTP Random Pad Renewal Without Extending Message [duplicate]

So I recently learned about the concept of a One Time Pad; and I from what I understand it means that if a XOR key is completely random and equal to or longer than the plaintext, it makes it so that ...
1
vote
1answer
91 views

Creating Random Pad from XORed Sections of Pi

If two strings of equal length from random offsets in Pi were XORed together, would this result in a cryptographically secure random number suitable for use in a one-time pad? If so, would this mean ...
1
vote
1answer
75 views

How should one handle the identity value and other "obviously" weak secret random values?

In RSA, ECDSA, ElGamal and quite a few other schemes, using a secret (random) value equal to 1 might not provide any form of security, while still being mathematically sound. For RSA, ECDSA or ...
0
votes
1answer
821 views

SHA256 output to 1-6 number range?

I want to calculate a random number (1 to 6) from the output of sha256. Can I assurance the probability of 6 abilities is the same?
1
vote
1answer
192 views

How does AES-GCM produce different ciphertexts, and how can the algorithm decrypt the values if they're random?

The title explains it. How does AES-GCM (or other modes for that matter) generate random ciphertexts per execution, and how does the algorithm decrypt a random value since the sender randomizes the ...
5
votes
2answers
330 views

What are usable entropy sources in a headless machine without /dev/random or any cryptography API?

If I have a headless machine (no mouse movements, no keyboard presses, or user input), without any cryptography CSPRNG APIs, where can I collect entropy from?
2
votes
2answers
142 views

Given a hash function; assuming domain % codomain = 0 and uniform collision distribution; how is entropy lost by collisions (not output truncation)?

Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective. It is widely agreed that randomly selecting a domain element ...
1
vote
1answer
134 views

Why doesn't the ability to sample a single random bit imply the construction of a random oracle?

I'm trying to understand exactly how the random oracle model differs from the standard model. In many proofs & applications there are some assumptions that some randomness is sampled (i.e. a bit $...
1
vote
1answer
280 views

What is the correct way to choose the start parameters for NIST tests? [duplicate]

I had an idea of creating a pseudo-random binary sequence with that code: ...
2
votes
1answer
54 views

Why are inputs to boolean functions usually modelled as random variables? [closed]

I ask this because it might one of those things that "everybody knows/does", but never gets written or explained anywhere... Is it just a matter of aesthetics (in the mathematical sense of the word), ...
1
vote
1answer
501 views

Why does the Fiat-Shamir heuristic not work without a random oracle?

Consider the following three stage interactive zero knowledge proof in round $i$ The prover sends some commitment $a_i$ to the verifier. The verifier picks a challenge $c_i\in \{0 ,1\}$ Depending on ...
1
vote
2answers
153 views

Is a number generator based on hashing an incremental string considered random?

Consider the following system 1 - fixed string as a seed, example "something" 2 - concat an increment number "something-1" 3 - hash it, assume it is "9f2054ea4d2c" 4 - take the first 3 digits to ...
1
vote
1answer
84 views

Is it possible to calculate the random factor $r$ from a encrypted message and the private key in a Paillier cryptosystem?

I have already done my research and found various sources that state that it is possible but there are also a lot of them that says it is not possible to recover $r$. This Q/A on this site for example ...
1
vote
4answers
342 views

Why does mt19937 fail the universal test in NIST SP 800-22?

Update: with the help of @SqueamishOssifrage and @PaulUzdak, we discovered that my NIST SP 800-22 has a broken universal test. So this becomes a moot question. Check this report. It seems to sail ...
1
vote
1answer
212 views

How can we reduce indistinguishability-from-random to other security notions?

In probabilistic encryption schemes, different notions of security exists. I'm interested in the relationship between two notions. One is the indistinguishability-from-random notion of security and ...
-1
votes
1answer
100 views

What is a popular entropy source for seeding a CSPRNG, which is actually weak and unreliable? [closed]

Say I want to seed a CSPRNG. What sources are popular, but unreliable? What sources should I even use?
2
votes
1answer
167 views

What is the most secure/reliable CSPRNG currently available? [closed]

In terms of period length, uniformity/distribution, what is the most secure/reliable CSPRNG currently available?
31
votes
6answers
5k views

What is the practical impact of using System.Random which is not cryptographically random?

I recently noticed a .NET software using PBKDF to derive an encryption key from a password string. This password string was ...
2
votes
2answers
177 views

Efficient way of generating a random number of N (less than 64) bits with exactly M bits equal to one [closed]

Would there be an efficient way to implement a function with the following signature: unsigned long long int random_word(size_t n, size_t m) that would generate ...
3
votes
1answer
484 views

Randomness Testing of Cryptographic Algorithim

I am new to algorithim randomness and confused at I guess a basic level question. Is it common for any cryptographic algorithim to have repetitions in its output i.e.let say 34 and D8 are two ...
2
votes
2answers
277 views

Statistical Analysis of Cryptographic Hashing Algorithms

I was wondering how can I use NIST Statistical Test Suite to check for the randomness of output generated by a cryptographic hashing algorithm, let say SHA-256? To be specific, how will I generate ...

1
2
3 4 5
9