Live data from Hacker News

Convert standard Geiger counter to RNG

github.com

41–42 of 42 posts

Re: Convert standard Geiger counter to RNG

#41
post #34

Earlier quoted context omitted.

Isn't that a matter of degree? RC4 leaks a lot. "Acceptable" ciphers leak so little, it's still not feasible to break the full version. But apparently this scales with increasing or reducing rounds. So it seems unlikely it ever goes to zero. It just gets near enough to zero, that there are no feasible attacks for some length of message.

No, it's not. A reasonable cryptanalytical model of a modern stream cipher (AED in a stream mode, or Salsa20, or whatever) is that --- within the birthday bounds of the underlying cipher (exabytes? you'd look it up, whatever you're using), and, in the case of something like an AEAD (or maybe just in the idiosyncratic case of GCM), the bounds of your nonce width --- they're not leaking _anything_. "Comical" really is…

within the birthday bounds of the underlying cipher (exabytes?

So modern stream ciphers do leak, just so slowly, it shouldn't ever matter in a practical sense if you're using them correctly? That was more or less my understanding to begin with, but maybe expressed ineptly.

the bounds of your nonce width --- they're not leaking _anything_

This reminds me of unicity distance. So under a certain number of outputs, one simply can't infer the internal state of the algorithm? It could be any number of internal states? That makes sense to me.

Re: Convert standard Geiger counter to RNG

#42
post #34

Earlier quoted context omitted.

No, it's not. A reasonable cryptanalytical model of a modern stream cipher (AED in a stream mode, or Salsa20, or whatever) is that --- within the birthday bounds of the underlying cipher (exabytes? you'd look it up, whatever you're using), and, in the case of something like an AEAD (or maybe just in the idiosyncratic case of GCM), the bounds of your nonce width --- they're not leaking _anything_. "Comical" really is…

within the birthday bounds of the underlying cipher (exabytes? So modern stream ciphers do leak, just so slowly, it shouldn't ever matter in a practical sense if you're using them correctly? That was more or less my understanding to begin with, but maybe expressed ineptly. the bounds of your nonce width --- they're not leaking _anything_ This reminds me of unicity distance. So under a certain number of outputs, one s…

I don't think "leak" is the right way to think about it. There's are birthday bounds on the transform and, for nonce-based modes, on the nonces used for successive encryptions. I'm not sure it's really meaningful to think about the incremental marginal degree of "leakage" with each successive ciphertext up to that limit. We're coming up to the limit of what I'm comfortable talking about though; this is normally the point where 'pbsd jumps in to explain why what I'm saying is dumb.
Post reply on HN