5 votes
Accepted

Good entropy from entropy test (90B) but still fail NIST800-22

The question tells that "95/100" of failed tests are Nonoverlapping tests. I previously pointed that's a significant statistical anomaly†, and it couldn't have been correctly tested a good ...
fgrieu's user avatar
  • 140k
5 votes

Why does NIST SP 800-90C RBG3 construction require XOR or reseeding a DRBG with a physical entropy source to produce full entropy?

Why does this recommendation require a RBG3 construction based on some physical entropy source to use a DRBG that is XOR'd or re-seeded by the entropy source to produce full entropy? Remember that ...
poncho's user avatar
  • 146k
3 votes
Accepted

Judgment of Results from NIST Randomness Testing

1.) The pass/fail threshold is printed at the bottom of the finalAnalysisReport.txt file. It looks like:- The minimum pass rate for each statistical test with ...
Paul Uszak's user avatar
  • 15.3k
3 votes

The security of using a digital signature scheme twice with randomness

The scheme is insecure; someone can, with two valid signatures, generate a valid signature to a different message. Suppose we have the signatures: $(r, \sigma_0, \sigma_1)$ a valid signature for the ...
poncho's user avatar
  • 146k
3 votes
Accepted

A HRNG that is NIST 800-90 compliant is not suitable for use for OTP generation right?

Is my understanding correct? Not quite. For an RBG1 or an RBG2 (either flavor), it is correct (unless the RBG2 was reseeded extremely often, that is, effectively turning it into an RBG3(RS); see ...
poncho's user avatar
  • 146k
3 votes
Accepted

From Entropy's perspective how Encryption affects a Message?

Everything I say here are completely theoretical, not backed by any research, and are completely opinions. There are 2 kinds of complexity we consider here: Data complexity: this is studied by ...
DannyNiu's user avatar
  • 9,080
3 votes

What are the state-of-the-art TRNGs today?

How fast are the fastest TRNGs? Which ones have the most entropy? This recent article claims 100 Gbit/s min-entropy, and gives reference to several >10 Gbit/s generators. These are lab experiments,...
fgrieu's user avatar
  • 140k
3 votes

What are the state-of-the-art TRNGs today?

How fast are the fastest ones? Chaotic laser emission is pretty much fastest. That's shoving a laser beam up itself. This one allegedly can be run at 1.2 Tbit/s:- That's a start for your further ...
Paul Uszak's user avatar
  • 15.3k
3 votes
Accepted

Walsh-Hadamard transform in randomness testing

You need to read about WHT. It is just a fourier transform obtained for $\pm 1$ valued sequences. A fourier transform is usually normalized in different ways. Some authors like to divide by $2^n$ (...
kodlu's user avatar
  • 21.9k
3 votes
Accepted

Frequency Monobits Test

Since the test uses $X_k=\pm 1$ as its symbols, it is statistically based on the idea of a simple random walk with unknown bias (if $p=1/2$ then the bias is zero). By the Central Limit Theorem, for an ...
kodlu's user avatar
  • 21.9k
2 votes

Why cant you use randomness to seed more randomness?

Suppose you take your 256 bits of handwavium "perfectly random data" and use it to seed a handwavium "perfect cryptographic seed expansion algorithm", such as the SHAKE XOF -- but ...
swineone's user avatar
  • 623
2 votes

Good entropy from entropy test (90B) but still fail NIST800-22

Welcome, and that's good :-) Ring oscillator perchance? 800-22 uses a critical value of $\alpha = 0.01$. That means one in a hundred tests will fail on average, even with the most randomnest of ...
Paul Uszak's user avatar
  • 15.3k
2 votes
Accepted

Are Universally Unique Lexicographically Sortable Identifiers (ULIDs) safe to use as a session id?

Almost certainly unsafe. If two or more ULIDs would be generated in the same millisecond, the "random" component is replaced by a counter. An attacker could issue requests, then try adding ...
SAI Peregrinus's user avatar
2 votes

Is it valid to transform the tested sample file and re-test, rather than invent additional randomness tests?

Is it valid? well yes, if data fails a test after transforming the data it fails the test. Is it as good as adding more tests? Well depends on the test and on the transformation. In general I would ...
Meir Maor's user avatar
  • 11.8k
2 votes
Accepted

Is it valid to transform the tested sample file and re-test, rather than invent additional randomness tests?

Sounds more so like a test for your tests using fuzzing. That could inform you of how sensitive your tests are to non-statistically consequential input transformations. But, only if your ...
aiootp's user avatar
  • 785
2 votes

Can the last n bitcoin blocks (including transactions) be reliable enough to be used as a seed for a PRNG or an input to a crypto hash-function?

Bitcoin, like most other blockchains, has a well-ordered collection of blocks. However, because the longest valid chain is the correct one, it may happen that, at a particular time, it's not clear ...
bk2204's user avatar
  • 3,046
2 votes

Is a pseudorandom function (PRF) also a one-way function (OWF)? If yes, how can we proof that a PRF $f_k$ is a OWF? If no, what is the closest work?

A PRF is a keyed function, or alternatively it is a family of functions indexed by a key. A OWF is a single public function. There is a mismatch between these two things. AES is a secure PRF (function ...
Mikero's user avatar
  • 12.5k
2 votes
Accepted

NIST random number tests report

C1 through C10 is a histogram of p values for the tests that you just ran. It represents the range of 0 <= p <= 1 partitioned into ten categories. So in the first line, you got two p values <...
Paul Uszak's user avatar
  • 15.3k
2 votes
Accepted

Does quantum-sourced randomness allow a potential random oracle instantiation?

For 2., why not use randomness from a quantum measurement outcome to achieve the coin flip? What part of this black box fails as a valid instantiation of a random oracle? Actually, it is precisely ...
poncho's user avatar
  • 146k
2 votes

A question about "attacks on MAC key space"

I read carefully this chapter but I still cannot understand this idea. Well, we assume that there is 1 correct key and $2^t - 1$ incorrect keys. When we test a key, the correct key will verify. We ...
poncho's user avatar
  • 146k
2 votes

From Entropy's perspective how Encryption affects a Message?

The source of entropy in encryption schemes is the secret key. Substitution and transposition ciphers are not secure methods of encryption because they are vulnerable to frequency analysis attacks. ...
lamontap's user avatar
  • 774
2 votes

Why are most KeyGen algorithms constructed to be probabilistic algorithms?

Here's a fully deterministic keygen algorithm in python for AES. Would you use this? I certainly wouldn't! def keygen(): return b"YELLOW SUBMARINE" ...
Marc Ilunga's user avatar
  • 3,163
2 votes
Accepted

Why are most KeyGen algorithms constructed to be probabilistic algorithms?

The purpose of key generation is to construct a key that your adversaries can't figure out. If your adversaries can figure out your key, then they can decrypt your secret data, or forge signatures, or ...
Gilles 'SO- stop being evil''s user avatar
1 vote
Accepted

How good is blake3 compared to a random oracle?

What you are asking is equivalent to asking how broken Blake3 is. If you can distinguish output of a cryptographic hash from a random oracle, it's considered broken[1]. The answer is that as far as ...
LightTunnelEnd's user avatar
1 vote
Accepted

Can this algorithm be called a RNG?

In order to produce a cryptographically secure pseudorandom number generator (CSPRNG), the output has to pass the next-bit test. Roughly, that means that if an attacker has a given amount of output ...
bk2204's user avatar
  • 3,046
1 vote

The security of using a digital signature scheme twice with randomness

This is a partial answer. The desired security goal (existential vs strong unforgeability or others?) hasn't been explicitly stated. Without restrictions, we can assume that (any) unforgeability is ...
Marc Ilunga's user avatar
  • 3,163
1 vote

A question about "attacks on MAC key space"

Firstly I thank to Poncho for your kind reply. But now I have a guess like this (maybe it is not author's intention): At first I think a number of keys corresponding to a number of outputs is the ...
hellobc's user avatar
  • 11
1 vote
Accepted

Why does NIST SP 800-90C RBG3 construction require XOR or reseeding a DRBG with a physical entropy source to produce full entropy?

Allegedly, it comes from this:- When n bits of output are requested from an RBG3(XOR) construction, n bits of output from the DRBG are XORed with n full-entropy bits obtained either directly from the ...
Paul Uszak's user avatar
  • 15.3k
1 vote

If we supply a random uuid4 hashed salt to Hashid, will it be considered secure?

The two projects you're discussing are both called "hash IDs", but they have very different security properties. https://pypi.org/project/hashID/ identifies common password hashes by their ...
bk2204's user avatar
  • 3,046
1 vote

Threshold Paillier encryption key generation time

Assuming a party can be trusted for key generation (which may or may not be the case in the question), key generation time in Paillier encryption is about that for RSA with $N$ of comparable size. To ...
fgrieu's user avatar
  • 140k

Only top scored, non community-wiki answers of a minimum length are eligible