New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

# Tag Info

Accepted

### A website that identifies an RNG from its output

A colleague of mine told me about a website that, given a sufficient quantity of output from an PRNG, had been able to deduce which application the PRNG was from. As you correctly identified this ...
• 46.1k

### A website that identifies an RNG from its output

One tool that tries to do this is untwister. It's almost certainly not the tool you were thinking of, though, as it cannot determine if the output came from OpenSSL specifically. It can determine ...
Accepted

• 20.2k
Accepted

### why do we take computational distinguishability over ensembles

Why not just define it over two distributions $X$ and $Y$? Because this is an asymptotic definition (using a negligible function explicitly). If you were to only consider two fixed distributions, ...
• 46.1k
Accepted

### Given an input x, can a distinguisher D output 1/2?

Such a distinguisher is certainly valid. In fact, in many proofs of security, we use this strategy. In particular, assume that there is some event that can be detected by $D$ with some non-negligible ...

### How to distinguish X25519 output from random?

Alice generates several $X_* = \operatorname{X25519}(S_*,P_*)$. If Alice uses the X25519 function, the output will belong to $\mathbb{F_{2^{255}-19}}$ and will represent a $X$-coordinate of a point ...
• 7,104
Accepted

### Can an adversary distinguish a private key from a pseudo-random string of the same length?

Usually choosing a safe password and standard parameter for the PBKDF2 key derivation would be enough protect your cipher. If PBKDF2 is correctly used, the symmetric key you get as output is well ...
• 3,334

### Can an adversary distinguish a private key from a pseudo-random string of the same length?

To basically summarize Ricky Demer's answer, regardless of how "random-looking" your private key is, an attacker can always recognize the correct private key as long as they have access to at least ...
• 46.1k
Accepted

### Computationaly efficient distinguisher for a PRP generator

a distinguisher is possible with 3 queries if we disregard efficiency. But how can we build an efficient distinguisher? I'm not sure exactly what you mean by efficient (since $n \approx 2^{27}$ is a ...
• 13.4k
Accepted

### Are two outputs of a PRF computationally indistinguishable when the keys are somehow related?

They are indistinguishable because the keys are related only by a value that random from the distinguisher's point of view. More formally, you can argue that your distribution is indistinguishable ...
• 13.4k
Accepted

• 48.6k

### Example of not computationally indistinguishable

The usual way of proving that two distributions are distinguishable is by devising an attack such as the one you mentioned. Finding an attack may not be easy or even doable. In general, you should ...
• 369
Accepted

### In SKE, can we assume without loss that the ciphers of a fixed plaintext distribute identically?

Is this possible without using any cryptographic assumptions which don't already follow from the existence of an IND-CCA1 secure SKE? Yes, symmetric-key encryption implies the existence of "...
• 13.4k

### Distinguishers and next bit predictors without the uniform distribution

Nice question! This seems to have been addressed in a conference paper also available here by Schrift and Shamir in 1991: A.W. Schrift, A. Shamir, On the universality of the next bit test, Conference ...
• 22.6k
The definition of the distinguishing advantage is a (pseudo)metric that captures the performance of some distinguished $D$ in distinguishing two experiments, say $E_0$ and $E_1$. The larger the value, ...