# Tag Info

2

No, not really. Your schematic is missing a crucial component called a decimator. The output of coupled ring oscillators (ROs) in the real world tends to not have as much jitter as in idealised literature. Essentially, there's little jitter as they tend to synch together under one system clock. It can look like:- The output from your NOR gates will be ...

3

I'll assume the right 16 in the question's figure is to tell that the LFSR is unloaded 16 bits at a time; and unless otherwise stated I'll assume that's done every 16 clock cycles of the LFSR. Is the LFSR sufficient to unbias the input? Mostly yes, but that's not enough in crypto. It's desired to make the output undistinguishable from random (no just ...

0

It looks mostly sound. Why are you returning logs? It is initialized to [] but never written to after that. Are you aware of Crypto.Random.random.sample(population, k)?

-1

Use a Zenner diode as noise generator, take sample of the noise voltage on the diode (through a capacitor), amplify it and measure the voltage with a ADC. After this process, extract the square root of this value and keep only the mantisa (numeric part after decimal point). It should deliver absolute true random numbers.

1

If plaintext $p$ is a variable with any distribution over $\{0,1\}^n$ and $k$ is an independent uniform random variable over $\{0,1\}^n$ then ciphertext $c = p ⊕ k$ is a uniform random variable over $\{0,1\}^n$.

2

I am wondering if you have an input $x_{1}$ and you XOR it with an unknown random second input $x_{2}$, is it safe to say that the resulting $x_{1}\oplus x_{2}$ will be random ? Yes, this is literally what proofs of the security of one-time pads come down to. Informally it comes down to the following observations: If $x_2$ is random, then it means that ...

0

This only works if the person (or coordinating group) selecting the seed for the VRF doesn't have control over the indexing of the candidates or the choice of x. If the person selecting the seed has control of the candidate indexing and knows x then they can make sure their prefered candidate is indexed at f(x) and is chosen. And if they have control over x ...

5

I will take a slightly different approach, a side step to a simpler problem to gain intuition. Let's say we have a fair 6 sided die. And we wish to draw a number uniformly from 1 to 4. It can't be done with a single dice roll. The single dice roll has enough entropy. More than the 2 bits we need. But it is impossible to map the dice roll results to a ...

5

The other answer actually says that you need 2527 bits of input for each 256 bits of hash output. That's 9.9 bits per bit, not much worse than 7. The same calculations gives 849 input bits per output bit if you use a 1-bit hash, but that doesn't mean there's no way to produce a first output bit with fewer than 849 input bits. The hashing approach isn't ...

4

Why are $\lceil 1/\operatorname{entropy-per-bit} \rceil$ number of bits not sufficient to generate an unbiased bit? Because the question is formulated for just one (nearly) unbiased bit to produce. For a large number of (nearly) unbiased bits to produce, that would be enough. Assume $n$ independent input bits $b_j$, each set with known probability exactly $\... 5 Entropy and bias are not the same. Yes, total entropy is additive so as you suggest 7 bits of badrand() produce a total of 1.064 bits of entropy. So? How would you use that? In cryptography we aim to use some source to produce a stream of independently and identically distributed random bits. Assume a plaintext ($p\$) of octets XORed with an octet keystream (...

Top 50 recent answers are included