New answers tagged

6 votes

Is there a cryptographic algorithm that can make a "lottery ticket"?

The primitive you are looking for is called a (two-party) coin-flipping protocol: an interactive, two-party protocol which allows two players to sample a random number without being able to bias the ...
user avatar
1 vote

Is there a cryptographic algorithm that can make a "lottery ticket"?

Bob generates a random number, hashes it with a cryptographically secure algorithm, and gives the hash to Alice Alice also generates a random number and sends her number to Bob Bob takes his number ...
user avatar
  • 562
0 votes

Is there a cryptographic algorithm that can make a "lottery ticket"?

Encrypted data and signatures should be virtually indistinguishable from random bits. If they are not, then there is likely a vulnerability in the algorithm. So I'm ignoring that and assuming an ...
user avatar
19 votes

Is there a cryptographic algorithm that can make a "lottery ticket"?

Bob picks an integer $n$ between 0 and 9 (inclusive), and a uniformly random 128-bit blinding factor $b$. Bob informs Alice of the hash commitment $c=H(n \mathbin\| b)$. $H()$ is a cryptographically ...
user avatar
  • 3,312
1 vote

Predicting the next output of Java Random with bound of 32

since your bound is a power of two its not that hard... (It takes a bit of brute force but its not that bad) ...
user avatar
  • 11
4 votes
Accepted

Uniform rejection sampling by shifting or rotating bits from CSPRNG output, safe?

Are those optimization safe to build arc4random_uniform ? No, they are not. If not, on what basis ? Because, after we test the value of result and reject it (...
user avatar
  • 134k
3 votes

ChaCha Single-Use RNG with All Zero Plaintext + Nonce

Given that the plaintext and nonce is known (all \x00), is this concerning for security? TL;DR: no. It's not a concern that plaintext and nonce are known. Neither is it a concern that the plaintext ...
user avatar
  • 125k
2 votes

Encrypt-then-MAC: full random keys or keys derived from master key?

The other answers are now out of date. You should derive both keys from the same input keying material using a KDF. If you randomly generate both keys, the construction will not be key- nor message-...
user avatar
-2 votes

Are small domain keyed permutations inherently unsafe?

No, of course not(ish). That's why cryptographic keys and their underlying blocks get bigger and bigger though time. Or would a small-domain permutation always allow brute-forcing of the key? In a ...
user avatar
5 votes
Accepted

Are small domain keyed permutations inherently unsafe?

No, small domain keyed permutations are not inherently unsafe, for some definition of unsafe adapted to the inherent limitations of a small domain. We can construct keyed permutation with a small ...
user avatar
  • 125k
1 vote

Are small domain keyed permutations inherently unsafe?

Since "small" is relative, conceptually we could use the AES with say 256 bit key and 128 bit blocksize. All of the below are impractical but illustrate the point: Building a codebook given ...
user avatar
  • 16.6k
0 votes

CS(P)RNG uniqueness

So, is the output of a CS(P)RNG unique? Generally no. First of all, if you take the definition of a CSPRNG here you will see that a stream cipher is something different than a DRBG as specified by ...
user avatar
  • 85.9k
1 vote

Dieharder tests on ATmega328p floating analogue pin A0 passing unexpectedly

No. No. Yesish. You can't use a floating ADC pin as a source of reliable entropy. There are two main reasons:- The input impedance of an Arduino ADC pin is $ \approx 100 \text{M} \Omega $. That ...
user avatar
2 votes
Accepted

What's the best approach to make PRNGs favourably deterministic a.k.a. biased and how to protect yourself against this?

This is very generic set of questions, so I'll answer the questions generically as well: How do you make a certain PRNG (in two scenarios - black box and the opposite of it) favour certain amount of ...
user avatar
  • 85.9k

Top 50 recent answers are included