3 ms·
I see a flaw with that prng scheme. Since AES is reversible, the 128-bit blocks that make up the output cannot repeat. The output is a permutation of distinct 1
by chowells 8y ago
I see a flaw with that prng scheme. Since AES is reversible, the 128-bit blocks that make up the output cannot repeat. The output is a permutation of distinct 128-bit blocks. Early in the sequence that only matters a tiny bit, but the longer it goes, the more that tells you about possible upcoming values.
- maxtaco 8y agoIn theory you are right, but in practice, flips take fewer than 10 blocks of AES output, so the sequence should look random unless AES is very broken. Edit (and meta-edit): I changed the wording in the FAQ accordingly.
- maxtaco 8y agoSeems like it's safe for 2^(64) blocks. That should suffice. https://security.stackexchange.com/questions/27776/block-chaining-modes-to-avoid/27780#27780 https://security.stackexchange.com/questions/27776/block-cha...