Random Numbers
boallen.com
Random Numbers
1–10 of 20 posts
Re: Random Numbers
#2All real crypto keys come from PRNGs (if they don't, you have bigger problems). If your PRNG sucks, you're in trouble. You aren't as secure as AES; you're as secure as your RNG.
Bernstein used a similar visualization to show diffusion in his stream cipher over multiple rounds:
Re: Random Numbers
#3[deleted]
Re: Random Numbers
#4[deleted]
The only conclusion you can draw from Reddit is that his pictures would be less interesting if you use mt_rand() instead of rand(). mt_rand() is still insecure.
Since published research on RNGs seems to severely lag research on block ciphers and even hash functions, it seems like a really bad idea to build anything that needs to be safe on an RNG that was never designed to be secure.
Re: Random Numbers
#5[deleted]
This was discussed here too, but I think it's an interesting article so I re-submitted it.
Re: Random Numbers
#6blocked at my work...Detected possible botnet command and control traffic.
Re: Random Numbers
#7[deleted]
This was discussed here too, but I think it's an interesting article so I re-submitted it.
My complaint had more to do with the fact that the article contains no date information than the fact it was resubmitted. Since it contains no date information someone that is seeing it for the first time might think this was a brand new issue and no one was aware of the problem.
Re: Random Numbers
#8Wrote a similar script a while back to vizualize any binary data. http://www.velvetcache.org/2010/03/15/bin2img-data-visualiza...
Re: Random Numbers
#9All real crypto keys come from PRNGs (if they don't, you have bigger problems). If your PRNG sucks, you're in trouble. You aren't as secure as AES; you're as secure as your RNG. Bernstein used a similar visualization to show diffusion in his stream cipher over multiple rounds: http://cr.yp.to/snuffle/diffusion.html
Well ... the last time I had to generate real crypto keys for an application I used a 300 US$ (in 1996) TRNG pod that used thermal noise to provide truly random data.
We can be rather sure that TRNGs are used to make one time pads for the intelligence community ... although strangely enough the Venona decrypts are based on the Soviets having reused pages of random numbers, probably due to the high demand that developed after they were invaded by Nazi Germany.
But your point about the need for a high quality (and well seeded) PNRG is well taken, far too many cryposystem failures have been due to that.
As I tell people, don't worry about the cipher, you will not do better than the experts, but make sure your whole system is sound.
And speaking of seeds, in the brave new world of cloud computing we've got to be careful about where we get our entropy.
Re: Random Numbers
#10[deleted]
The only conclusion you can draw from Reddit is that his pictures would be less interesting if you use mt_rand() instead of rand(). mt_rand() is still insecure. Since published research on RNGs seems to severely lag research on block ciphers and even hash functions, it seems like a really bad idea to build anything that needs to be safe on an RNG that was never designed to be secure.
I certainly wasn't trying to debate the value of mt_rand or it's implementation of the Mersenne Twister. I was simply trying to point out this is an extremely old issue, and that the problem specified in the article (a visible problem with rand()) is removed by using mt_rand(). Also, the issue only occurs due to problems with the PRNG on Windows specifically and was not present on other operating systems. The use of php's rand() or mt_rand() for applications that require security seems to be outside the scope of the article as it was presented since the author didn't necessarily understand the topic as can be seen by his proposed solutions.