Questions tagged [randomness]
Usage of randomness (i.e. non-predictable data, usually in the form of bits or numbers) for cryptographic purposes.
541
questions
-1
votes
1
answer
213
views
Does the following protocol of secure a matrix satisfy one-time-pad?
Problem Definition:
Alice wants to send a matrix $MR_A$ which encrypts its original private matrix $M_A$ ($M\times N$ size, all elements in $M_A$ is in {0,1,2,3,4,5}) to Bob without letting Bob knows ...
- 13
0
votes
1
answer
70
views
Why does l'Ecuyer reject p-values close to 1?
When applying several tests to a given generator, p-values smaller
than 0.01 or larger than 0.99 are often obtained by chance even if the
RNG behaves correctly with respect to these tests (such values ...
1
vote
0
answers
67
views
NIST STS randomness testing inconsistent results
I have generated the nine datasets according to this document for AES-128 and testing these for randomness using NIST STS. However, the results are inconsistent. Sometimes there appear a * in the ...
- 2,397
5
votes
2
answers
930
views
What's wrong with NIST SP 800-90B?
NIST SP 800-90B offers various tests for estimating entropy. They also offer an implementation of these tests. With their program called ea_iid, estimating ...
- 85
5
votes
3
answers
3k
views
Why is the output of a True Random Number Generator (TRNG) insecure after it has been compressed?
I came across the following statement regarding true random number generators (TRNG):
A “P1 medium” [AIS31] true random number generator (TRNG) may not be directly used due to cryptographic reasons. ...
- 51
3
votes
2
answers
529
views
Distribution of the Difference of Uniformly Random Elements
In the search to decision reduction of 'On Ideal Lattices and Learning with Errors over Rings', the authors implicitly use the fact that the difference of distinct, uniformly random elements of a (...
- 381
0
votes
0
answers
171
views
Randomness Testing of Block Ciphers with 256-bit Block/ Key length
NIST explained the process of "Randomness Testing of the AES Candidate Algorithms" in the document.
The document explains the generation of 9 datasets for AES candidates with 128-bit block ...
- 2,397
1
vote
1
answer
145
views
How can we define $\epsilon$-differential privacy for non-deterministic algorithms?
We know that non-trival deterministic algorithm does not guarantee privacy and randomization is essential for privacy (pp.16 in [Dwork and Roth 2014] ). The well-known $\epsilon$-diferential privacy ...
- 111
-1
votes
1
answer
125
views
Explaining the reason of radically more accuracy while using different set of hash functions instead of same set of hash functions on some operations
So I am looking for an explanation of an experiment.
In this experiment, I took a set of k hash functions. Say the total number of data points I am working on is d. Call an algorithm A which used that ...
7
votes
1
answer
115
views
What quality of randomness is needed for randomized side channel countermeasures?
Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES ...
- 45.7k
3
votes
1
answer
125
views
randomness of encrypt
In the paper "Efficient Encryption from Random Quasi-Cyclic Codes" of Gaborit et al. p.14, I read "Encrypt$(pk=(G,Q,s),\mu,\theta)$: uses randomness $\theta$ to generate $\epsilon \...
- 113
0
votes
0
answers
74
views
RNG randomization strength for PRF seed
Consider a use case that requires the creation of multiple asymmetric key pairs. There are two options for generating random seeds for a PRF:
Use a software based RNG and generate a new seed for each ...
2
votes
2
answers
2k
views
Is it possible to create a 128-bit UUID from a weak entropy source?
I am looking at a seemingly popular piece of JavaScript code to generate a UUID which is supposed to be a 128-bit number:
...
- 123
3
votes
1
answer
885
views
Using SHA2 as random number generator?
I need to generate secure pseudorandom numbers in an embedded system. Instead of having to port some RNG library, could I just use an existing SHA2 function as a random number generator (n-th random ...
David
0
votes
0
answers
74
views
What is the probability that a random function is invertible?
Having a random function - $R\in{}\mathcal{R}$
s.t.
$R:\{0,1\}^n\rightarrow{}\{0,1\}^n$.
What is the probability that $R$ is invertible?
I know calculating it suppose to be straight forward, but I'...
- 113
3
votes
1
answer
100
views
Hide Randomness in Ciphertext
Ciphertext has the property to appear random. As a matter of fact, randomness is the first test, an encryption algorithm must pass. However, there are various setups, which monitor the incoming/ ...
- 389
1
vote
2
answers
202
views
Extracting Randomness from a Poisson Distribution
I'm working on a quantum random number generator based on the shot noise of CMOS camera sensor. Shot noise in an image is caused by the variance of the number of photons hitting the sensor per unit of ...
1
vote
1
answer
188
views
random mask reversible after homomorphic encryption
I would like to know if this process is feasible under homomorphic encryption, ideally under paillier or any other additive scheme
Apply a mask X to obfuscate a message A ie. Am = A (op) X where (op)...
- 75
1
vote
1
answer
171
views
Can hashes be used to generate larger random numbers?
As far as I understand a hash transforms data into a fixed length representation. For example, a random function returns 8-byte numbers and a hash function has a block size of 32-bytes. If I now ...
- 13
1
vote
1
answer
43
views
Does splitting random data reduce its security?
Let's say I've got some securely-generated random data I want to encode as words, 32 bits of it. My wordlist is 2048 words, so each word encodes 11 bits of information. I write a routine to pack ...
- 13
18
votes
2
answers
5k
views
A website that identifies an RNG from its output
This happened during a discussion of RNG entropy, and the difficulty of verifying the level of entropy in a long sequence of bits (e.g. a private key.)
A colleague of mine told me about a website ...
- 299
2
votes
2
answers
1k
views
Why is Math.floor(Math.random()*9000) not secure in JavaScript?
I heard that one can predict the output from Math.Random() of JavaScript, but another day I had an idea to combine Math.random() ...
- 33
3
votes
1
answer
222
views
What is a "set synchronized CSPRNG"?
I'm looking to implement a performant revocation method for JWTs. I'm reading a paper, in which the following section's second paragraph states:
If we use the client hashing approach described ...
- 131
2
votes
1
answer
704
views
Dieharder input file with a sequence of only binary numbers
I have a RNG producing sequences of binary numbers, ad I would like to run Dieharder test using them as an ascii txt input file. However I haven't been able to do it properly. Should I use a header ...
- 31
1
vote
0
answers
90
views
libgcrypt and rdrand usage
For some reasons, I was looking into libgcrypt source code and found this.
If I understand this correctly, while asking to use /dev/random for some bytes, it actually checks first if rdrand is ...
- 11
2
votes
2
answers
610
views
Mathematical definition of deterministic and non-deterministic random bit generators
Can anyone give the mathematical definition of deterministic and non-deterministic random bit generator?
Providing a reference will also be very helpful.
- 157
1
vote
0
answers
145
views
Would the result of encrypting weak random data via AES-128 with a CSPRNG-generated key be considered strong/secure random data?
I am trying to understand the security implications of using a well known block (or stream but in this example block) cipher like AES-128 to produce pseudo-random data.
My specific question is would ...
- 111
2
votes
2
answers
218
views
Doesn't d6 to binary for 256-bit bitcoin private key generation produce biased results?
If the mapping table looks like:
1: 000
2: 001
3: 010
4: 011
5: 100
6: 101
Then you are guaranteed that your key will never have a chain of 4 or more 1s, much fewer chains of 3 ones than would ...
- 23
10
votes
3
answers
1k
views
Perfect shuffle possible with limited raw entropy?
I am trying to shuffle a standard 52-card deck in a perfect way (every outcome should be possible at an equal chance). I am not, at this point, concerned with cryptanalysis attacks against it.
I have ...
- 211
1
vote
2
answers
803
views
The importance of randomness in the creation of a key
Why does it matter what kind of random number generation is used during key generation?
E.g. this answer states ...
- 119
1
vote
0
answers
147
views
Why does a "never-repeating" nonce limit a key to safely encrypt only a single block?
This questions comes from a section outlined in RFC 5297 on SIV-AES. The paragraph in particular outlines the idea of a never repeating nonce vs an "almost always" non-repeating nonce.
If ...
- 111
0
votes
0
answers
252
views
Crack LCG given 2 output values only
I want to try to break an LCG generator just as programming practice task. I found similar issue at Cracking a linear congruential generator.
Assume that m is given. The answer to the link above ...
- 101
1
vote
0
answers
52
views
OTP Random Pad Renewal Without Extending Message [duplicate]
So I recently learned about the concept of a One Time Pad; and I from what I understand it means that if a XOR key is completely random and equal to or longer than the plaintext, it makes it so that ...
- 11
1
vote
1
answer
96
views
Creating Random Pad from XORed Sections of Pi
If two strings of equal length from random offsets in Pi were XORed together, would this result in a cryptographically secure random number suitable for use in a one-time pad? If so, would this mean ...
- 13
1
vote
1
answer
83
views
How should one handle the identity value and other "obviously" weak secret random values?
In RSA, ECDSA, ElGamal and quite a few other schemes, using a secret (random) value equal to 1 might not provide any form of security, while still being mathematically sound.
For RSA, ECDSA or ElGamal,...
- 7,629
0
votes
1
answer
1k
views
SHA256 output to 1-6 number range?
I want to calculate a random number (1 to 6) from the output of sha256. Can I assurance the probability of 6 abilities is the same?
- 45
1
vote
1
answer
645
views
How does AES-GCM produce different ciphertexts, and how can the algorithm decrypt the values if they're random?
The title explains it. How does AES-GCM (or other modes for that matter) generate random ciphertexts per execution, and how does the algorithm decrypt a random value since the sender randomizes the ...
- 516
5
votes
2
answers
507
views
What are usable entropy sources in a headless machine without /dev/random or any cryptography API?
If I have a headless machine (no mouse movements, no keyboard presses, or user input), without any cryptography CSPRNG APIs, where can I collect entropy from?
- 516
2
votes
2
answers
233
views
Given a hash function; assuming domain % codomain = 0 and uniform collision distribution; how is entropy lost by collisions (not output truncation)?
Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective. It is widely agreed that randomly selecting a domain element ...
- 177
1
vote
1
answer
155
views
Why doesn't the ability to sample a single random bit imply the construction of a random oracle?
I'm trying to understand exactly how the random oracle model differs from the standard model. In many proofs & applications there are some assumptions that some randomness is sampled (i.e. a bit $...
- 105
1
vote
1
answer
641
views
What is the correct way to choose the start parameters for NIST tests? [duplicate]
I had an idea of creating a pseudo-random binary sequence with that code:
...
- 15
2
votes
1
answer
61
views
Why are inputs to boolean functions usually modelled as random variables? [closed]
I ask this because it might one of those things that "everybody knows/does", but never gets written or explained anywhere... Is it just a matter of aesthetics (in the mathematical sense of the word), ...
- 252
1
vote
1
answer
971
views
Why does the Fiat-Shamir heuristic not work without a random oracle?
Consider the following three stage interactive zero knowledge proof in round $i$
The prover sends some commitment $a_i$ to the verifier.
The verifier picks a challenge $c_i\in \{0 ,1\}$
Depending on ...
- 693
1
vote
2
answers
398
views
Is a number generator based on hashing an incremental string considered random?
Consider the following system
1 - fixed string as a seed, example "something"
2 - concat an increment number "something-1"
3 - hash it, assume it is "9f2054ea4d2c"
4 - take the first 3 digits to ...
- 113
1
vote
1
answer
115
views
Is it possible to calculate the random factor $r$ from a encrypted message and the private key in a Paillier cryptosystem?
I have already done my research and found various sources that state that it is possible but there are also a lot of them that says it is not possible to recover $r$. This Q/A on this site for example ...
- 11
1
vote
4
answers
792
views
Why does mt19937 fail the universal test in NIST SP 800-22?
Update: with the help of @SqueamishOssifrage and @PaulUzdak, we discovered that my NIST SP 800-22 has a broken universal test. So this becomes a moot question.
Check this report. It seems to sail ...
- 409
2
votes
1
answer
573
views
How can we reduce indistinguishability-from-random to other security notions?
In probabilistic encryption schemes, different notions of security exists. I'm interested in the relationship between two notions. One is the indistinguishability-from-random notion of security and ...
- 191
-1
votes
1
answer
132
views
What is a popular entropy source for seeding a CSPRNG, which is actually weak and unreliable? [closed]
Say I want to seed a CSPRNG. What sources are popular, but unreliable? What sources should I even use?
- 39
2
votes
1
answer
478
views
What is the most secure/reliable CSPRNG currently available? [closed]
In terms of period length, uniformity/distribution, what is the most secure/reliable CSPRNG currently available?
- 39
32
votes
6
answers
5k
views
What is the practical impact of using System.Random which is not cryptographically random?
I recently noticed a .NET software using PBKDF to derive an encryption key from a password string. This password string was ...
- 687