Live data from Hacker News

Cracking Random Number Generators Using Machine Learning

research.nccgroup.com

51–60 of 100 posts

Re: Cracking Random Number Generators Using Machine Learning

#51
post #48
post #43

Earlier quoted context omitted.

No it isn’t.

A fundamentally entropic phenomenon is discovered to be patterened. It would be like looking through a microscope and seeing voxels. How is this not strong evidence for simulation?

It could just as easily be evidence of a previously non-understood physical phenomenon or mechanism being recognized by new methods.

Of course, that’s exactly the kind of thing a simulation would type!

Re: Cracking Random Number Generators Using Machine Learning

#52
post #33

Earlier quoted context omitted.

The argument is fairly straightforward: Let n be the number of seed bits of the CSPRNG. Assume there exists an ANN that approximates the CSPRNG so that the number of possibly wrong output bits is at most polylogarithmic in n (otherwise you haven't really gained much insight from the ANN). Assume further that the ANN is sufficiently small so that a forward pass through the ANN takes at most polynomial time in n. Then…

The difference is that ANNs make approximations. It could be manageably small and learn an approximation of the PRNG code that succeeds for a large number of outputs, even if running a fully accurate network is impossible. I think the complexity of the PRNG recursive algorithm , when unrolled through time for large number of steps, is the relevant complexity here. The ANN is not necessarily trying to devise a new fun…

The proof accounts for that. You can even allow for the ANN being totally wrong on "almost all" seeds except for a non-negligible fraction, the definition of a CSPRNG allows for that. If it is wrong for all but a negligible fraction of seeds, then you haven't gained much over random guessing. So the only way that an ANN could help is if the ANN approximation is sufficiently bad that it doesn't give you any significant speedup in cracking the CSPRNG.

Of course, this is assuming that practical CSPRNGs conform to the theory, but we're just debating theory here.

Re: Cracking Random Number Generators Using Machine Learning

#53
post #36

Earlier quoted context omitted.

> That's somewhat equivalent of partially seeing the secret internal state Not just partially, xorshift128 is designed such that the output depends only on the last 4 results. So this is "just" learning the output function of xorshift as a neural network.

Perhaps you might consider how big that output function ideally is, then compare to the capacity of the neural network they used and the number of samples provided.

My reading of it is that it's essentially one-to-one (up to minor constant factors), they took the binary circuit for xorshift128 and replace the xor gates by functionally equivalent NN blocks, and then trained the weights.

Re: Cracking Random Number Generators Using Machine Learning

#55

Earlier quoted context omitted.

It would also work for PCG. You're simply modeling the PRNG and learning the internal state from outputs. It's even easier using Z3 or your own SAT solver. I've broken pretty much all non-crypto PRNGS using Z3, and it's trivial to do so. You simply model the PRNG in Z3, with unknown constants, plug in a few values from the output (or even parts of output, or even non-consecutives ones, anything you derive from them,…

How do you pick how many constants and they're relationships?

I think that’s the “You simply model the PRNG in Z3” part.

Whether that’s simple depends is debatable, but for example would be if somebody open-sourced the server-side of their poker dealing site.

Re: Cracking Random Number Generators Using Machine Learning

#57
post #48
post #43

Earlier quoted context omitted.

No it isn’t.

A fundamentally entropic phenomenon is discovered to be patterened. It would be like looking through a microscope and seeing voxels. How is this not strong evidence for simulation?

Isn’t the quantum nature of reality already like looking through a microscope and finding voxels?

I don’t see why finding underlying structure in what we expect to be pure noise has to mean our reality is a simulation. I guess it could be consistent with that, but couldn’t it also be consistent with some previously undiscovered physics, much like the development of quantum mechanics?

Re: Cracking Random Number Generators Using Machine Learning

#58

This is pretty hilarious. I just noticed that this is published by NCC Group. (Former NCC Group pentester here, and now I happen to be an ML engineer.) I don't think HN's negativity is warranted. But there's also some confusion, which I'd like to help clear up. People here seem confused about "Why? Why do this?" The answer is simply that it's an interesting problem. That's it. It doesn't need to be important, or a pr…

[deleted]

Re: Cracking Random Number Generators Using Machine Learning

#59

This is pretty hilarious. I just noticed that this is published by NCC Group. (Former NCC Group pentester here, and now I happen to be an ML engineer.) I don't think HN's negativity is warranted. But there's also some confusion, which I'd like to help clear up. People here seem confused about "Why? Why do this?" The answer is simply that it's an interesting problem. That's it. It doesn't need to be important, or a pr…

[deleted]

Re: Cracking Random Number Generators Using Machine Learning

#60
post #55

Earlier quoted context omitted.

How do you pick how many constants and they're relationships?

I think that’s the “You simply model the PRNG in Z3” part. Whether that’s simple depends is debatable, but for example would be if somebody open-sourced the server-side of their poker dealing site.

It's quite simple. Z3 supports every basic integer option out of the box. You literally write the same code as the original prng. Instead of a uint32, or uint64, or float32, etc., you use the Z3 equivalent type. That's it. You define the state as unknown, but same Z3 type as in C or JavaScript. Then you run the function once. Set it to the output you see, repeat a few observed outputs, then tell Z3 to solve for the original unknown state.

It's absolutely trivial, taking a few lines of code.

I've broken all sorts of code using similar tools.

Post reply on HN