3 ms·

I've read that post now and previously (though not its references) and I feel that it never gets to the point where it explains how urandom can be equally safe

I've read that post now and previously (though not its references) and I feel that it never gets to the point where it explains how urandom can be equally safe as random. Is the idea not that it is information-theoretically safe, but rather that the computational requirements are too great to figure out the state of the random-number generator even after a large amount of observed output?

schoen 9y ago
Yes, it's partly about comparing the security model of CSPRNGs to the security model of ciphers (and I think some of the CSPRNG constructions are extremely closely related to popular ciphers and hash functions). Part of the argument is that a cipher can encrypt an extremely large amount of data under the same key, and in the same way a CSPRNG can create an extremely large amount of pseudorandom output from a small seed. In some cases, deriving the internal state of the CSPRNG from observed outputs should be as difficult as deriving the secret key of a cipher from observed ciphertext or from known plaintext/ciphertext pairs. Maybe tptacek can do another go-round on this topic and make this more explicit (because he certainly still gets frustrated about people's intuitions when it comes up). There was something either in that piece or in another one by another crypto expert saying that if we don't believe that CSPRNGs have this security property, we shouldn't believe in the symmetric ciphers that we use them to generate key material for either, because they are constructed using the same kinds of techniques. I also don't remember what Matthew Green disagreed with Thomas about here.
JdeBP 9y ago
Then you might find that Thomas Hühn's approach helps you. * https://www.2uo.de/myths-about-urandom/ https://www.2uo.de/myths-about-urandom/ The "another crypto expert" mentioned by schoen is Daniel J. Bernstein, quoted directly by Hühn.
- schoen 9y ago
  Indeed, thanks! That was the other piece that I was thinking of and couldn't find right away.
- Bromskloss 9y ago
  I guess this kind of, maybe, explains it, though in an oblique way, and even that only because I was already on the lookout for something about information-theoretical security vs. computational security. It mostly brings up misconceptions I never had, and attacks those. For example, why would it matter that /dev/random gets its output from the same CSPRNG as /dev/urandom (or any other CSPRNG)? Shouldn't the output of the CSPRNG, assuming its state is large enough, contain as much entropy as its input? The focus on giving me orders about what I should do, rather than telling me why, also gets old somewhere around the first time.

schoen 9y ago

Yes, it's partly about comparing the security model of CSPRNGs to the security model of ciphers (and I think some of the CSPRNG constructions are extremely closely related to popular ciphers and hash functions). Part of the argument is that a cipher can encrypt an extremely large amount of data under the same key, and in the same way a CSPRNG can create an extremely large amount of pseudorandom output from a small seed. In some cases, deriving the internal state of the CSPRNG from observed outputs should be as difficult as deriving the secret key of a cipher from observed ciphertext or from known plaintext/ciphertext pairs. Maybe tptacek can do another go-round on this topic and make this more explicit (because he certainly still gets frustrated about people's intuitions when it comes up). There was something either in that piece or in another one by another crypto expert saying that if we don't believe that CSPRNGs have this security property, we shouldn't believe in the symmetric ciphers that we use them to generate key material for either, because they are constructed using the same kinds of techniques. I also don't remember what Matthew Green disagreed with Thomas about here.

JdeBP 9y ago

Then you might find that Thomas Hühn's approach helps you. * https://www.2uo.de/myths-about-urandom/ https://www.2uo.de/myths-about-urandom/ The "another crypto expert" mentioned by schoen is Daniel J. Bernstein, quoted directly by Hühn.

schoen 9y ago
Indeed, thanks! That was the other piece that I was thinking of and couldn't find right away.
Bromskloss 9y ago
I guess this kind of, maybe, explains it, though in an oblique way, and even that only because I was already on the lookout for something about information-theoretical security vs. computational security. It mostly brings up misconceptions I never had, and attacks those. For example, why would it matter that /dev/random gets its output from the same CSPRNG as /dev/urandom (or any other CSPRNG)? Shouldn't the output of the CSPRNG, assuming its state is large enough, contain as much entropy as its input? The focus on giving me orders about what I should do, rather than telling me why, also gets old somewhere around the first time.