110

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of Entropy. Try to win! So we don't rely on whether generating a random number from the mind or random keyboard typings and mouse movements that seem like a monkey ...


66

For example, for a target bitstring of 100 bits, I cannot scan all bitstrings of 100 bits and XOR each with the target, hoping to recover the message. This approach will produce all messages that can be expressed with 100 bits. That's not the reason why one-time-pads are considered secure. The reason is that even if you try all possible keys that you get ...


49

"PRNG" means "Pseudorandom Number Generator" which means that a sequence of numbers (bits, bytes...) is produced from an algorithm which looks random, but is in fact deterministic (the sequence is generated from some unknown internal state), hence pseudorandom. Such pseudorandomness can be cryptographically secure, or not. It is cryptographically secure if ...


45

You asked for the practical impact, so the answer is that for \$120 I could probably have your entire password database done by tomorrow. Here is your program, or something similar to it: using System; using System.Text; using System.Security.Cryptography; class Program { static void Main(string[] args) { byte[] pwd = new byte[128]; ...


38

What are the criteria that make an RNG cryptographically secure? In short, a DRBG [deterministic random bit generator] is formally considered computationally secure if a computationally-limited attacker has no advantage in distinguishing it from a truly random source. What does this mean? Given a DRBG F and a truly random oracle G, let A be a probabilistic ...


35

The ISO/IEC 9899:1990 edition of the C standard contains: EXAMPLE     The following functions define a portable implementation of rand and srand. static unsigned long int next = 1; int rand(void) // RAND_MAX assumed to be 32767 { next = next * 1103515245 + 12345; return (unsigned int)(next/65536) % 32768; } void srand(unsigned int ...


35

The title of this article is complete hype. Tip: when a journalist says “X could solve Y”, read “X probably won't solve Y”. Much of the content of the article is hype too. Cryptography has a random number problem, but the problem is not producing random numbers, and the proposal in this article wouldn't be useful to produce random numbers anyway. ...


34

I think you're misinterpreting the source. The source says the TRNGs "rely" on compression (a cryptographic hash would be the compression function, or possibly some simpler function to increase throughput). The random data isn't insecure after compression, it's insecure before compression. Why? When you roll dice there's an equal probability of it ...


32

A colleague of mine told me about a website that, given a sufficient quantity of output from an PRNG, had been able to deduce which application the PRNG was from. As you correctly identified this would present an immediate and probably devastating attack to any cryptographic PRNG as it indeed would allow you to easily distinguish a random string from a PRNG ...


31

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology going on that may cause people to be less random than they are intending to be (Wikipedia links to a paper claiming humans are in fact bad at this). Or perhaps ...


28

One tool that tries to do this is untwister. It's almost certainly not the tool you were thinking of, though, as it cannot determine if the output came from OpenSSL specifically. It can determine Glibc's rand(), Mersenne Twister (MT19937), PHP's MT-variant (php_mt_rand), Ruby's MT-variant DEFAULT::rand(), and Java's Random() class, though, and can recover ...


26

A True Random Number Generator uses a physical phenomenon not known to be fully deterministic as origin of the discrete values (bits or integer numbers) that it outputs. That phenomenon can for example be a dice throw, thermal noise, disintegration of a radioactive substance… What detects this phenomenon can be followed by a conditioning stage to turn the ...


26

From what you have described, it sounds like your system works as follows: Consult the system clock to find a 32-bit seed $s$. Use System.Random to generate a passphrase $p = G(s)$. (Here $G$ is shorthand for whatever computation happens inside System.Random.) Hash the passphrase with PBKDF(2?) into output $x = H(p, \sigma)$, where $\sigma$ is a salt known ...


24

To begin with, your definition of perfect secrecy is non-standard. The standard definition is given in an excellent answer to the question how is the OTP perfectly secure?. Essentially, perfect secrecy means that observing the ciphertext does not affect the relative likelihoods of various plaintexts under the unknown key. So the fact that different ...


22

I would characterize the service as similar to a trusted time-stamping service. Except they do not do the time-stamping, but just provide the "key". This allows a user to decide what do to with it, such as using it as a private key to sign something, or an HMAC key, proving the signature is "not older" than the timestamp. If the signature is published to a ...


22

How many hex digits do I need to compare when manually checking hash functions? If you actually want the full security guarantees of the hash function to apply: all of them. I usually just look at the first/last 5 or 6 hex digits and call it good enough. This effectively reduces the security of the hash function to that of one that only outputs 10-...


21

The other answers provide very good lists of reasons not to use Twitter as an entropy source. What follows is the flip side of your question:- Why would you want to? Tweets are typically read on tablets, PCs and phones. All of those have access to hardware entropy sources that can produce oodles of truly random bits for seeding anything. The zeitgeist is ...


20

What you are suggesting is not a good idea for a general purpose random number generator. It could be meaningful for very specific use cases if you need a random number generator whose output can be verified independently by a third party. Even in those cases there are other sources of entropy which are potentially more suitable. The oldest mention of this ...


18

The key element in the definition of a PRG is the observer (aka distinguisher, algorithm, test, etc) that the PRG is supposed to fool. A statistical PRG fools a specific set of observers, whereas a cryptographic PRG fools all efficient observers. This strong definition is essential for cryptography:: The only assumption the designer should make about the ...


18

The official documentation for System.Random explicitly says it should not be used for generating passwords. It’s predictable, and seeded only from the system clock. This means System.Random has at most 20 bits of entropy to anyone who has a clock accurate to within a second. Indeed, try creating two new instances in quick succession on different threads; ...


18

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. If you ask humans to generate a random sequence, they will probably pay attention not to use the same character in a row, i.e., aa or bb, as they think that ab ...


17

I tried to use mostly non-jargon to make it more understandable than the current top answer. What are the criteria that make an RNG cryptographically secure? From en.wikipedia.org/wiki/CSPRNG: Given all outputs so far, there must not be any algorithm that predicts future outputs with anything better than guessing. If you can say "there is a 50.0001% ...


17

Assuming that $b = 2^k-1$ for some positive integer $k$, XORing two (or more) numbers in the range $[0,b]$ will indeed yield a number in the same range. If the numbers are random, uniformly distributed over the range and independent, then the result will also be random and uniformly distributed. In fact, we can even prove a stronger result saying that if ...


16

Randomness is not a property of strings of bits (or characters of any sort). Rather it is a property of the process that generates those strings. However, it is convenient to conflate the string with the thing that produced the string, and thus to speak about strings being “random” or “not random”. The string 00000, for example, is random if it was the ...


16

What kind of numbers are needed for cryptography/security? Are those integers? Bits. Simply have your TRNG generate random bits. As mentioned in the other answer, the only difference between bits/hex/integers/etc is in the formatting and representation. It is almost certainly more appropriate and simpler to generate random bits than it is to rely on some ...


15

We simply strive for crypto that's as close as possible to ideal. Indistinguishably is the strongest property we can demand from a PRNG/streamcipher. It's hard to predict which non ideal properties will lead to problems at some point in the future. For example the non ideal properties that lead to padding oracles, BEAST, CRIME or the RC4 biases were known ...


15

How are you going to decide which tweet to use? Randomly? This quickly leads to a chicken / egg problem. What if the chosen tweet is one word? That would not add a lot of entropy. What if twitter is unavailable? Are you just stopping your service that relies on the entropy or are you going to continue regardless? How are you going to keep the chosen tweet ...


15

Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess." Your sample string is hard for a human to guess, but it isn't very random. There is a tool called "ent" for most Unix systems that can quantify the randomness, by some measures, of a file. Available here: https://...


14

The key difference between the two is that a random number generator used for cryptographic purposes has to stand up to an attacker. When you use random numbers in statistics, the main thing you care about is that the output sequence "looks random." What that means in practice is that it passes a bunch of statistical tests, showing that the distribution of ...


14

Say I hashed the output from a random number generator (with nonce), would the resulting SHA256 hash be as random as the inputted number? Let's suppose you flipped a perfectly fair coin. You flip it 1024 times to create a bit string of 1024-bits. Because the coin is perfectly fair, this means that each strings of 0s and 1s will appear with precisely the ...


Only top voted, non community-wiki answers of a minimum length are eligible