Randomness with OneRNG and NeuG [LWN.net]

Randomness with OneRNG and NeuG

Posted Jun 25, 2015 22:35 UTC (Thu) by gerdesj (subscriber, #5446)
In reply to: Randomness with OneRNG and NeuG by samroberts
Parent article: Randomness with OneRNG and NeuG

"The output of a stream cipher is also indistinguishable from random, but is absolutely predictable."

I don't know a huge amount about this but I presume you mean predictable if and only if you know the algorithm used to generate the stream and associated parameters.

to post comments

Randomness with OneRNG and NeuG

Posted Jun 25, 2015 22:44 UTC (Thu) by samroberts (subscriber, #46749) [Link] (6 responses)

Yes.

An NSA preferred "TRNG" device would be constructed from a stream cipher, its output would satisfy all randomness "tests", and the NSA would know all of its outputs. Thus, not random.

The Linux PRNG is similar to a stream cipher, its a cascade of hashes. Its output always "looks" random, but it is only actually random if its input is unknown, which is why the system PRNG needs seeding with true randomness to be secure.

Randomness with OneRNG and NeuG

Posted Jun 25, 2015 23:07 UTC (Thu) by gerdesj (subscriber, #5446) [Link] (5 responses)

Thanks for the explanation.

BTW, I get around worries with NSA "intrusion" with my comms by generating 10 x 2048 bit DH params on different machines and splicing 10 randomly chosen parts together to make up the final one. I use multiple coin tosses to binary search my start points. I also regenerate the whole keys daily.

Now that's how to get real PFS 8)

Strong crypto is easy if you only just apply a little lateral thought. I don't bother with insecure USB devices for my TRNG: I have hired 10,000 Mechanical Turks to toss coins and I scrape the results straight into the input for my mechturk_entropyd.

Cheers
Jon

Randomness with OneRNG and NeuG

Posted Jun 26, 2015 9:06 UTC (Fri) by amonnet (guest, #54852) [Link]

"I have hired 10,000 Mechanical Turks to toss coins and I scrape the results straight into the input for my mechturk_entropyd."

Been there, done that :
https://www.youtube.com/watch?v=7n8LNxGbZbs

Randomness with OneRNG and NeuG

Posted Jun 26, 2015 9:24 UTC (Fri) by andresfreund (subscriber, #69562) [Link] (3 responses)

> Strong crypto is easy if you only just apply a little lateral thought. I don't bother with insecure USB devices for my TRNG: I have hired 10,000 Mechanical Turks to toss coins and I scrape the results straight into the input for my mechturk_entropyd.

If you're indeed talking about the amazon thing, that sounds far easier to influence by some TLA than noise in your soundcard, delays in your hdd positioning, etc.

Randomness with OneRNG and NeuG

Posted Jun 26, 2015 9:47 UTC (Fri) by gerdesj (subscriber, #5446) [Link] (2 responses)

"If you're indeed talking about the amazon thing, that sounds far easier to influence by some TLA than noise in your soundcard, delays in your hdd positioning, etc."

It was a joke and it turns out someone else has already told it and YouTubed it.

My real points were:
* A decent source of entropy still has to travel from the source to the thing that consumes it, via routes that can be compromised
* A source that could create decent entropy may not do so (some of my "Turks" generates far more coin tosses than the rest - perhaps by hitching up a stream cipher)
* Silly ideas like "tweaking" or "augmenting" existing algos are doomed to failure - my DH improvement is rather unlikely to create a usable DH param!

Cheers
Jon

Randomness with OneRNG and NeuG

Posted Jun 26, 2015 9:51 UTC (Fri) by andresfreund (subscriber, #69562) [Link] (1 responses)

Ok, I should not have replied before having my first coffee. Good morning.

Randomness with OneRNG and NeuG

Posted Jun 26, 2015 9:54 UTC (Fri) by gerdesj (subscriber, #5446) [Link]

"Ok, I should not have replied before having my first coffee. Good morning."

I probably should have spelt out what I meant in the original post - that was way after first glass of wine.