4 ms·

Practically, yes. But consider one-time pad or Shamir secret sharing: they stop being information-theoretically secure if you use such conditioning.

by dchest 7y ago

lisper 7y ago
> they stop being information-theoretically secure if you use such conditioning No, that's not true. As long as you put more entropy in than you take out then you retain IT-security. But there is no rational reason to care about that.
- dchest 7y ago
  IT-security would be achieved only if the output of hash function is truly random (uniformly and independently distributed). You need to create a randomness extractor that turns entropy from a source into a truly random bit sequence. What hash function that you know of does this?
  - lisper 7y ago
    > IT-security would be achieved only if the output of hash function is truly random (uniformly and independently distributed). That is the definition of a cryptographically secure hash. One can quibble over whether or not any available hash function is in fact a CSH. But if you believe that any of the algorithms that are widely considered to be CSHs are in fact CSHs then the rest is easy.
    - dchest 7y ago
      > That is the definition of a cryptographically secure hash. It is not! None of the cryptographically secure hashes are proven to produce truly random output. They only strive to achieve indistinguishability from randomness, bounded by computational complexity of attacks. Anyway, what you're talking about, in general, is called a randomness extractor. The protocol described in the article, apart from verification, uses "a strong quantum-proof randomness extractor to extract Ω(N) bits of randomness from the recorded string". So yeah, "pure, verifiable randomness is hard to come by".
      - lisper 7y ago
        > > That is the definition of a cryptographically secure hash. > It is not! You're right, it's the definition of a secure psuedo-random function (PRF). https://en.wikipedia.org/wiki/Pseudorandom_function_family https://en.wikipedia.org/wiki/Pseudorandom_function_family However, all cryptographic hashes are PRFs. Any deviation from being a PRF would be an attackable weakness.

Practically, yes. But consider one-time pad or Shamir secret sharing: they stop being information-theoretically secure if you use such conditioning.

by dchest 7y ago

Practically, yes. But consider one-time pad or Shamir secret sharing: they stop being information-theoretically secure if you use such conditioning.

lisper 7y ago

> they stop being information-theoretically secure if you use such conditioning No, that's not true. As long as you put more entropy in than you take out then you retain IT-security. But there is no rational reason to care about that.

dchest 7y ago
IT-security would be achieved only if the output of hash function is truly random (uniformly and independently distributed). You need to create a randomness extractor that turns entropy from a source into a truly random bit sequence. What hash function that you know of does this?
- lisper 7y ago
  > IT-security would be achieved only if the output of hash function is truly random (uniformly and independently distributed). That is the definition of a cryptographically secure hash. One can quibble over whether or not any available hash function is in fact a CSH. But if you believe that any of the algorithms that are widely considered to be CSHs are in fact CSHs then the rest is easy.
  - dchest 7y ago
    > That is the definition of a cryptographically secure hash. It is not! None of the cryptographically secure hashes are proven to produce truly random output. They only strive to achieve indistinguishability from randomness, bounded by computational complexity of attacks. Anyway, what you're talking about, in general, is called a randomness extractor. The protocol described in the article, apart from verification, uses "a strong quantum-proof randomness extractor to extract Ω(N) bits of randomness from the recorded string". So yeah, "pure, verifiable randomness is hard to come by".
    - lisper 7y ago
      > > That is the definition of a cryptographically secure hash. > It is not! You're right, it's the definition of a secure psuedo-random function (PRF). https://en.wikipedia.org/wiki/Pseudorandom_function_family https://en.wikipedia.org/wiki/Pseudorandom_function_family However, all cryptographic hashes are PRFs. Any deviation from being a PRF would be an attackable weakness.