4 ms·

Is it better than a webcam image piped through sha256?

by VMG 9y ago

IgorPartola 9y ago
No? Yes? Neither? Both? I've seen enough of these discussions to be able to parrot back to you some of the usual responses. Basically, say that you point your webcam at a perfectly black sheet (0x000000 in color). Will you get any actual entropy from this? No. Now say you point your webcam at the night sky. On a clear night, I will more or less know what your camera is looking at, and will be able to to narrow down the huge field of possible values presented by sha256 to a much smaller set of possibilities. Knowing when you generated your private key and your method of getting entropy, I will be able to crack your key much easier (doesn't mean easy, just many orders of magnitude easier). Now, say you point your webcam at a lava lamp, or the display showing characteristics of some quantum process, or something else provably random. Here I can't really tell wtf your camera is looking at. I can of course go and slide that black sheet in front of your camera for a bit. Or stand in front of it. But if you physically secure your camera, then yeah you are doing something right (though of course not everything, as it's quite possible that something in your algorithm is in fact reducing your possible output to only some subset of possible values produced by sha256). It's the same thing with radio. If you tune it to a signal that's producing a sine wave with a stable frequency... I know exactly what your input is. If you tune it to something like the BBC, I know exactly what your input is, even with some noise. If you tune it to something really random, can I just put a very strong transmitter near your receiver and overwhelm the spectrum such that you are listening to only my signal? And the best part is that you won't know that this is happening even more than with a webcam. Personally, I wouldn't really want to trust these devices. They are fun. but they aren't practical for this purpose. Where you need real entropy is a data center. And a data center won't be receiving too much radio. Again, parroting every other thread about this, a reverse biased transistor will give you true quantum randomness which is very cheap, very easy to produce, and is difficult to temper with at a distance without disrupting the rest of your equipment too. Again, you don't need as much entropy as you think. Your kernel will seed a CSPRNG with a tiny bit of entropy, which is enough to keep you safe for eons after that. You can't "run out" of entropy with that scheme. The biggest issue is to initialize the random number generator with true entropy before you start using it, which is only difficult if you are running virtual machines and the host doesn't provide entropy to it. I believe at least in some schemes the seed used is based on time or some such predictable factor, which doesn't help.
- tjoff 9y ago
  How will you be able to reduce the field of possible values presented by sha256 if you approximately know the source image? There is still noise in the image and several orders of magnitude more data. You assume that brute forcing similar images and hashing the result would be easier than just brute forcing the sha256.
  - IgorPartola 9y ago
    That's exactly what I assume. If I know 90% of the image, but need to brute force 10%, I just reduce the possible field of values by an order of magnitude. The better I know what the image was to begin with, the easier it gets. That's exactly why poor RNGs are bad: I can brute force the value by knowing your method + approximately your input. And if I can affect the image in a way that makes it even more predictable (black sheet over the camera, bright white light into the camera), it gets even easier.
    - vokep 9y ago
      but unless the image is very low resolution, chances are sha256 is a smaller space no?
    - silotis 9y ago
      Doing a little back-of-the-envelope math, a 1080p image has a total of 1920x1080x3 = 6,220,800 subpixels. That means each subpixel needs to have less than 0.00004 bits of entropy for there to be less than 256 bits in a single image. Surely a typical consumer CCD will introduce more noise than that. A potential catch is that the noise is likely correlated to a degree. Still, it's not clear that even a webcam pointed at a black sheet of paper is insufficient as a source of entropy.
    - tjoff 9y ago
      10% of 1 megapixels divided by 24 is 4166. So, even if you only consider the least significant bit of one of the three subpixels in 10% of the image you still have 16 times more information than what you can represent in a SHA256 hash from a measly 1 megapixel image. I think it is valid to question how you could reduce the search space enough to be more beneficial than brute forcing SHA256.

Is it better than a webcam image piped through sha256?

by VMG 9y ago

Is it better than a webcam image piped through sha256?

No? Yes? Neither? Both? I've seen enough of these discussions to be able to parrot back to you some of the usual responses. Basically, say that you point your webcam at a perfectly black sheet (0x000000 in color). Will you get any actual entropy from this? No. Now say you point your webcam at the night sky. On a clear night, I will more or less know what your camera is looking at, and will be able to to narrow down the huge field of possible values presented by sha256 to a much smaller set of possibilities. Knowing when you generated your private key and your method of getting entropy, I will be able to crack your key much easier (doesn't mean easy, just many orders of magnitude easier). Now, say you point your webcam at a lava lamp, or the display showing characteristics of some quantum process, or something else provably random. Here I can't really tell wtf your camera is looking at. I can of course go and slide that black sheet in front of your camera for a bit. Or stand in front of it. But if you physically secure your camera, then yeah you are doing something right (though of course not everything, as it's quite possible that something in your algorithm is in fact reducing your possible output to only some subset of possible values produced by sha256). It's the same thing with radio. If you tune it to a signal that's producing a sine wave with a stable frequency... I know exactly what your input is. If you tune it to something like the BBC, I know exactly what your input is, even with some noise. If you tune it to something really random, can I just put a very strong transmitter near your receiver and overwhelm the spectrum such that you are listening to only my signal? And the best part is that you won't know that this is happening even more than with a webcam. Personally, I wouldn't really want to trust these devices. They are fun. but they aren't practical for this purpose. Where you need real entropy is a data center. And a data center won't be receiving too much radio. Again, parroting every other thread about this, a reverse biased transistor will give you true quantum randomness which is very cheap, very easy to produce, and is difficult to temper with at a distance without disrupting the rest of your equipment too. Again, you don't need as much entropy as you think. Your kernel will seed a CSPRNG with a tiny bit of entropy, which is enough to keep you safe for eons after that. You can't "run out" of entropy with that scheme. The biggest issue is to initialize the random number generator with true entropy before you start using it, which is only difficult if you are running virtual machines and the host doesn't provide entropy to it. I believe at least in some schemes the seed used is based on time or some such predictable factor, which doesn't help.

tjoff 9y ago
How will you be able to reduce the field of possible values presented by sha256 if you approximately know the source image? There is still noise in the image and several orders of magnitude more data. You assume that brute forcing similar images and hashing the result would be easier than just brute forcing the sha256.
- IgorPartola 9y ago
  That's exactly what I assume. If I know 90% of the image, but need to brute force 10%, I just reduce the possible field of values by an order of magnitude. The better I know what the image was to begin with, the easier it gets. That's exactly why poor RNGs are bad: I can brute force the value by knowing your method + approximately your input. And if I can affect the image in a way that makes it even more predictable (black sheet over the camera, bright white light into the camera), it gets even easier.
  - vokep 9y ago
    but unless the image is very low resolution, chances are sha256 is a smaller space no?
  - silotis 9y ago
    Doing a little back-of-the-envelope math, a 1080p image has a total of 1920x1080x3 = 6,220,800 subpixels. That means each subpixel needs to have less than 0.00004 bits of entropy for there to be less than 256 bits in a single image. Surely a typical consumer CCD will introduce more noise than that. A potential catch is that the noise is likely correlated to a degree. Still, it's not clear that even a webcam pointed at a black sheet of paper is insufficient as a source of entropy.
  - tjoff 9y ago
    10% of 1 megapixels divided by 24 is 4166. So, even if you only consider the least significant bit of one of the three subpixels in 10% of the image you still have 16 times more information than what you can represent in a SHA256 hash from a measly 1 megapixel image. I think it is valid to question how you could reduce the search space enough to be more beneficial than brute forcing SHA256.