New answers tagged

0

I noticed that this question is very similar to a CTF i am doing.Please do not crowd source CTF questions you should be disappointed.


28

One tool that tries to do this is untwister. It's almost certainly not the tool you were thinking of, though, as it cannot determine if the output came from OpenSSL specifically. It can determine Glibc's rand(), Mersenne Twister (MT19937), PHP's MT-variant (php_mt_rand), Ruby's MT-variant DEFAULT::rand(), and Java's Random() class, though, and can recover ...


31

A colleague of mine told me about a website that, given a sufficient quantity of output from an PRNG, had been able to deduce which application the PRNG was from. As you correctly identified this would present an immediate and probably devastating attack to any cryptographic PRNG as it indeed would allow you to easily distinguish a random string from a PRNG ...


2

The Math.random() in ECMA-262/JavaScript should return a Number value with positive sign, greater than or equal to 0 but less than 1, chosen randomly or pseudorandomly with approximately uniform distribution over that range, using an implementation-dependent algorithm or strategy. There's nothing to say that it is cryptographically secure, therefore the ...


3

No, as you won't be switching the nonce on a per message basis, just outputting a stream of random data. However, remember, your key will only produce an output stream valid until the internal counter overflows. Consider XChaCha20. IETF ChaCha20 uses a 96-bit nonce and 32-bit counter, XChaCha20 uses a 192-bit nonce and 64-bit counter. The 64-bit counter ...


3

According to this answer, math.random uses a Linear Congruential Generator (although it is not clear to me if that's on one specific browser, or on all JavaScript implementations). In any case, a Linear Congruential Generator is known not to be secure, in the sense that, given partial output (which the Math.floor( 9000 * Math.random() ) operation allows), ...


3

Yes. Throughout this, I will make the assumption (which appears to be the case) that random.shuffle() permutes the list in a way that only depends on: The seed used The length of the list being shuffled This is to say that, for a fixed seed and fixed length of a list (say $n$), random.shuffle() chooses some permutation $\sigma\in S_n$, and then sends the ...


19

The RFC specifies things in terms of bits. Each call to HMAC outputs hlen bits. tlen is the count of bits obtained so far; when at least qlen bits have been obtained, this step is finished. The sample code is written in Java in which the elementary unit of information is the octet ("byte" in usual terminology). The supported hash functions always output a ...


5

In cryptography you usually want to use min-entropy (which is a lower bound on security) instead of shannon-entropy (which can be higher than the security if the attacker is content with breaking only a fraction of the targets). Min-entropy is simply $-\log p$ where p is the probability of the most likely value. In this case this works out to: $$-16 \cdot \...


10

First of all the first Entropy calculation is not correct. Recall the definition of (Shannon) entropy: $$H(X) = -\sum_{i=1}^n {\mathrm{P}(x_i) \log_{\,b} \mathrm{P}(x_i)}$$ If uniformly chosen a digits entropy is $$H(X) = -\frac{1}{10} \log_2\left(\frac{1}{10}\right) = 3.3219280...$$ Case $<250$ with 16 digits; \begin{align} H_1(X) &= 16 \cdot - ...


1

As David Wong commented, NIST has proposed CTR-DRBG as the secure way to do it. Here is a link to an implementation in Python using CTR-AES-128. However, it should be noted that quite recently (2019-11) a side-channel attack was published (by Lauren De Meyer, COSICS) to recover the key and a nonce using only 256 power traces of CTR-AES. Thus, one should be ...


6

Define the Mutual Information of a pair of random variables. $$I(X; Y) = H(X) - H(X\mid Y)$$ For discrete random variables we hae that $H(X\mid X) = 0$, so: $$I(X; X) = H(X)$$ The Data-Procesing Inequality states that for any function $f$, we have that: $$I(f(X); f(Y)) \leq I(X; Y)$$ While we won't need it here, this includes randomized functions, provided ...


Top 50 recent answers are included