3 ms·

> Depends on how quickly state bits leak. If the state only leaks 2 bits per minute Fixed, but I'm assuming you're actually using the RNG; if you only generate

by a1369209993 7y ago

> Depends on how quickly state bits leak. If the state only leaks 2 bits per minute Fixed, but I'm assuming you're actually using the RNG; if you only generate 2 bits of output per minute, you can get away with all kinds of dumb crap. > So it depends on the definition of "block". It's the same definition as any other (2)read syscall. Assuming a 32-byte read from /dev/random[0], it's equivalent to reading from a pipe with at least 32bytes buffered if the RNG is already initialized (read returns immediately); if the RNG is not initialized, its the same as reading from a empty pipe - the kernel switches to some other process after making a note to resume the calling process when some event happens ((2)write for a pipe, RNG initialization for /dev/random). 0: Or /dev/urandom, which should be literally the same character device, because there are never any legitimate reasons for them to differ.

wahern 7y ago
> if you only generate 2 bits of output per minute, you can get away with all kinds of dumb crap. If outputting 2 bits leaks 2 bits of state, you're probably not using a cryptographically strong PRF.
- a1369209993 7y ago
  Regardless of your RNG algorithm, outputting 2 bits always[1] leaks a 2 bit state. If your state is only 2 bits[0], then there are only 4 possible states. With significant probability, your two output bits will be inconsistent with 3 of them. In general, a N bit output will be inconsistent with 2^N - 1 of your 2^N possible internal states; the point of using ~256 bits of entropy is to ensure that it's computationally intractable to figure out which, and that only works if the attacker can't work out the first (second, etc) 32 bits separately from the subsequent ones. 0: of entropy, mind, not data. If the attacker knows your 64-byte RNG buffer, and you inject 2 bits of entropy, there are only 2^2=4 new 64-byte blobs that your buffer could have evolved to, so you have 512 bits of data with only 2 bits of entropy. 1: for any algorithm that is; on a per-event basis, there's obviously a chance that you happen to produce output that's consistent with multiple possible internal states.
- benchaney 7y ago
  You are misunderstanding the issue. If you only have two bits of entropy, than outputting two bits leaks the entire state, because two bits is brute forceable. This is true regardless of the quality of your RNG. The same is true of 32 bits, because 32 bits is also brute forceable. The reason to insert entropy in large chunks is so that an attacker cannot brute force the RNG state, between reseeds.

wahern 7y ago

> if you only generate 2 bits of output per minute, you can get away with all kinds of dumb crap. If outputting 2 bits leaks 2 bits of state, you're probably not using a cryptographically strong PRF.

a1369209993 7y ago
Regardless of your RNG algorithm, outputting 2 bits always[1] leaks a 2 bit state. If your state is only 2 bits[0], then there are only 4 possible states. With significant probability, your two output bits will be inconsistent with 3 of them. In general, a N bit output will be inconsistent with 2^N - 1 of your 2^N possible internal states; the point of using ~256 bits of entropy is to ensure that it's computationally intractable to figure out which, and that only works if the attacker can't work out the first (second, etc) 32 bits separately from the subsequent ones. 0: of entropy, mind, not data. If the attacker knows your 64-byte RNG buffer, and you inject 2 bits of entropy, there are only 2^2=4 new 64-byte blobs that your buffer could have evolved to, so you have 512 bits of data with only 2 bits of entropy. 1: for any algorithm that is; on a per-event basis, there's obviously a chance that you happen to produce output that's consistent with multiple possible internal states.
benchaney 7y ago
You are misunderstanding the issue. If you only have two bits of entropy, than outputting two bits leaks the entire state, because two bits is brute forceable. This is true regardless of the quality of your RNG. The same is true of 32 bits, because 32 bits is also brute forceable. The reason to insert entropy in large chunks is so that an attacker cannot brute force the RNG state, between reseeds.