3 ms·
At a guess, it is 18000% susceptible to government interference, meaning you'd have to read 180 announcements like this before you got to one that wasn't active
by logicallee 9y ago
At a guess, it is 18000% susceptible to government interference, meaning you'd have to read 180 announcements like this before you got to one that wasn't actively created by the government. (Not just "interfered with" after the fact, but actively created for the express purpose of being predictable by them.)
First let me explain how prior probability works to you guys.
Imagine that I tell you these two facts: there is a bag (perhaps very large) with both fair coins and exceedingly unfair coins in it - such as coins so heavily weighted that they land "heads" approximately 90% of the time.
You draw a coin at random and flip it a few times, and get the sequence: heads, heads, heads, heads, heads, heads, heads, heads, heads, heads. (10 heads.)
What do you think the likelihood is that you drew a fair coin?
You might think it's exceedingly unlikely.
However, if I then told you there were 2046 fair coins and only two weighted coins in the bag, it turns out you'd be down to 50/50. If there were a billion fair coins and 1 weighted coin, you'd be almost certain to have drawn a fair coin.
The fact that you just threw ten heads pales in comparison with the prior probability.
Now what we're looking at is that you flipped it ten times and it seems totally normal. But the bag is full of ten thousand heavily weighted coins and only one fair coin.
It doesn't matter how great ("fair") the announcement looks, because we know from historical reasons the prior probability that it's actually fair.
Reading through the announcement with these eyes you get:
>However, demonstrably unpredictable values are not possible to obtain in any classical physical context.
Which is pretty absurd. Reading the brownian motion of molecules with a sensor will not allow anyone to predict when the next molecule hit. XOR-ing two classical independent processes so that the second process has no access to the first and vice versa removes any remaining possibility of error. If any source in an independent xor chain is random the rest can be weighted and it's no problem, because xor is a commutative operation, you can rewrite the chain so the random source is last, and it will act as an OTP. So just a couple of low-tech classical noisy sources of entropy are more than enough.
Instead we have a very sophisticated setup that can be backdoored at a very low level, and almost certainly is.
A plausible reason for this announcement is so that writers of backdoored cryptography can use the output of this as a putatively random seed, both claiming an honest mistake for using it in cryptography, and also perhaps writing architecture that seems not to require a truly random source but can in fact be broken by a source whose upcoming values are known to the government.
What you're looking at is almost surely a government program to help other government programmers produce broken cryptography.
When combined with the prior probability, there is almost no chance (perhaps 1 in 200) that the architecture in the write-up has been produced for any other purpose, or cannot be predicted by someone having access to the sequence and special information on the process used to produce it.
-
EDIT: downvoters don't understand the analysis. Sorry.
- rand_r 9y ago> You draw a coin at random and flip it a few times, and get the sequence: heads, heads, heads, heads, heads, heads, heads, heads, heads, heads. (10 heads.) > What do you think the likelihood is that you drew a fair coin? Given that any sequence of {heads, tails} is equally likely to any other sequence of {heads, tails} for a fair coin, what information does flipping the coin give you? There's no way to disprove that a coin is fair.
- logicallee 9y agoMy question was about likelihood. If I present you with exactly two coins, visually indistinguishable, but you know that one is very heavily weighted and one is unweighted coin. Then by repeatedly flipping them, you could reach incredible confidence (99.9999%) within a few minutes regarding which is which. Rather than a "proof" you should think about the payoff if you then had to bet about which was which and then it was revealed. If one landed heads 105 times and tails 3 times in your quick test, there is a conceivable universe in which that was the fair coin. But you would not accept 200:1 payoff to bet that that is the fair coin. You are much more confident than 200:1 that it is the weighted coin.
- sushisource 9y agoYou can't assign probability to human motivations. You're making this enormous assumption about human motivation in the last three paragraphs that has nothing to do with your "probability proof". Even assuming you're right, why would they put in giant red text "DON'T USE THIS FOR CRYPTOGRAPHY" at the top, if their goal was to get you to use it for cryptography? Nonsense
- logicallee 9y agoI based the prior probability on NIST's past behavior with respect to backdoors. https://google.com/search?q=nist+backdoor https://google.com/search?q=nist+backdoor Further, I reviewed the architecture in the write-up. If they wanted a random beacon that was not backdoored, they would xor it with samples from a lava lamp or something simple and unpredictable and point a web cam at it that anyone can see. As explained, this cannot reduce the randomness. They would not carefully design an architecture that is possible to backdoor, which is what we are reading about. As for the reason why they say it should not be used in cryptography, I addressed these in my original comment. In my estimation the chances that the government can predict the output of this random beacon are 200:1 in favor. You are free to disagree, that's fine.