3 ms·

> When you use a whitener you have to choose how many output bits to extract for a give number of input bits. If you extract more than the quality of your sourc

> When you use a whitener you have to choose how many output bits to extract for a give number of input bits. If you extract more than the quality of your source allows, you lose. Crypto is not my area of expertise, but this seems to contradict other things I've read. For example, in the debate about whether /dev/random should block, I seem to recall tptacek saying something like this: the idea that we have ciphers we can't break, but we have randomness sources that "run out" of entropy, doesn't pass the cryptographer's laugh test. I think someone else put it this way: seed AES with, say, 512 random bits, and then you can encrypt as many zero bits as you want to generate your random numbers; as long as AES itself is secure, you're not in any danger. That doesn't mean it's not a good idea to keep mixing in external entropy, of course, as long as that's easy to do and doesn't itself give an attacker a way to influence the results (I seem to recall seeing a paper about this somewhere). But it doesn't seem to be essential, if you believe those arguments. What do you think about this?

lisper 10y ago
That is an excellent question! There are two separate issues here: 1. How many bits of real entropy can you count on getting out of a TRNG in a given amount of time? 2. How many bits can you safely extract from a PRNG that has been seeded with N bits of entropy? This discussion is about issue #1. The /dev/random vs /dev/urandom arguments are about issue #2. Just for the record, the answer to #2 is: once your PRNG has been seeded with "enough" entropy, you can safely extract an essentially infinite amount of pseudo-randomness out of it (where "essentially" means that there might be a theoretical limit, but you won't encounter it before the heat death of the universe). (How much entropy is "enough"? Again, it depends on how paranoid you want to be. 128 bits is barely enough. 256 is plenty. 512 is overkill.)
HelloNurse 10y ago
Running out of TRNG entropy is a problem when the random number is used as a secret key or the equivalent, because for an adversary such a low-entropy value is easier to guess than it should. The effective number of possible keys is reduced. Use of the defective sample as a PRNG seed or something else is irrelevant.

lisper 10y ago

That is an excellent question! There are two separate issues here: 1. How many bits of real entropy can you count on getting out of a TRNG in a given amount of time? 2. How many bits can you safely extract from a PRNG that has been seeded with N bits of entropy? This discussion is about issue #1. The /dev/random vs /dev/urandom arguments are about issue #2. Just for the record, the answer to #2 is: once your PRNG has been seeded with "enough" entropy, you can safely extract an essentially infinite amount of pseudo-randomness out of it (where "essentially" means that there might be a theoretical limit, but you won't encounter it before the heat death of the universe). (How much entropy is "enough"? Again, it depends on how paranoid you want to be. 128 bits is barely enough. 256 is plenty. 512 is overkill.)

HelloNurse 10y ago

Running out of TRNG entropy is a problem when the random number is used as a secret key or the equivalent, because for an adversary such a low-entropy value is easier to guess than it should. The effective number of possible keys is reduced. Use of the defective sample as a PRNG seed or something else is irrelevant.