4 ms·

> That instruction is a flaw in the experiment. It's always impossible to tell, for any given sequence, whether it was produced by a fair die. There's nothing a

> That instruction is a flaw in the experiment. It's always impossible to tell, for any given sequence, whether it was produced by a fair die. There's nothing an experimental subject can do to make the impossible more impossible. Baloney! Say you measure the traffic to your website in the morning and the evening, every day for a week. And this is what you see: day: 1 1 2 2 3 3 4 4 5 5 6 6 7 7 time: M E M E M E M E M E M E M E visitors: 51 73 58 72 50 78 55 74 55 77 52 73 55 76 It could be that the traffic you get is uniformly random, and each day the number of visitors you get is a uniformly random number between 50 and 80. Sure, all the morning numbers are less and the evening numbers are more and there are suspiciously no numbers in the 60s. All that could be a coincidence. You know perfectly well, though, that you're getting more traffic in the evenings.

denton-scratch 4y ago
You've answered a different question. The question is: can you construct a sequence of dice-casts that an adversary can't distinguish from a real dice-cast? Answer: you can't.
- a1369209993 4y ago
  > The question is: can you construct a sequence of dice-casts that an adversary can't distinguish from a real dice-cast? Yes, obviously: A: 2 4 4 3 5 2 3 6 4 2 B: 5 5 5 6 4 1 1 2 4 5 One is a real dice-cast with a d6 I had lying around. The other is the (100% deterministic) output of: echo 1651434259 $X | md5sum | grep -o '[1-6]' | paste -sd' ' for some X. Feel free to explain[0] how you are able to distinguish which is which. The real issue is that most people don't bother to produce random numbers in a way that's actually secure (which, to be fair, is rather tedious if you don't have a computer handy, and downright prohibitively impractical if you want to do it all in your head, so why would you bother?), either in the study or in general. 0: If you'd like a more black-box distinguishment, I can provide a longer list; obviously a adversary can get the right answer 50% of the time just by chance.
  - denton-scratch 4y ago
    Not sure that I'm disagreeing with you; but: Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? If you can't distinguish a spoof from the real article, then that blade has two edges. It's impossible to distinguish them, so the instruction in the pudding test that you are to make a sequence that is indistinguishable from a dice-cast is meaningless, because any sequence is indistinguishable from a dice-cast. If you ask people to do impossible things before breakfast, then it's not sensible to do an analysis of what they end up doing. It's a waste of time.
    - a1369209993 4y ago
      > Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? With high probability (over the distribution of possible dice-casts to distinguish it from), yes: A: 6 4 3 2 1 4 5 1 6 5 B: 1 1 1 1 1 1 1 1 1 1 Same procedure (A=constructed,B=10d6,xchg A <=> B if another d6 is >3), but this time I clearly don't need to explain how the constructed sequence was constructed. The adversary will sometimes get it wrong because 10d6 came up "1 1 1 1 1 1 1 1 1 1" itself (or something equally-plausible like "6 6 6 6 6 6 6 6 6 6"), but they'll do much better than random guessing. Whereas being able to do better than random guessing against a CSPRNG/stream cipher means the cryptographic primitive is completely broken. (I'm not sure it's a direct break for a hash function, but it's still pretty bad.)

denton-scratch 4y ago

You've answered a different question. The question is: can you construct a sequence of dice-casts that an adversary can't distinguish from a real dice-cast? Answer: you can't.

a1369209993 4y ago
> The question is: can you construct a sequence of dice-casts that an adversary can't distinguish from a real dice-cast? Yes, obviously: A: 2 4 4 3 5 2 3 6 4 2 B: 5 5 5 6 4 1 1 2 4 5 One is a real dice-cast with a d6 I had lying around. The other is the (100% deterministic) output of: echo 1651434259 $X | md5sum | grep -o '[1-6]' | paste -sd' ' for some X. Feel free to explain[0] how you are able to distinguish which is which. The real issue is that most people don't bother to produce random numbers in a way that's actually secure (which, to be fair, is rather tedious if you don't have a computer handy, and downright prohibitively impractical if you want to do it all in your head, so why would you bother?), either in the study or in general. 0: If you'd like a more black-box distinguishment, I can provide a longer list; obviously a adversary can get the right answer 50% of the time just by chance.
- denton-scratch 4y ago
  Not sure that I'm disagreeing with you; but: Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? If you can't distinguish a spoof from the real article, then that blade has two edges. It's impossible to distinguish them, so the instruction in the pudding test that you are to make a sequence that is indistinguishable from a dice-cast is meaningless, because any sequence is indistinguishable from a dice-cast. If you ask people to do impossible things before breakfast, then it's not sensible to do an analysis of what they end up doing. It's a waste of time.
  - a1369209993 4y ago
    > Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? With high probability (over the distribution of possible dice-casts to distinguish it from), yes: A: 6 4 3 2 1 4 5 1 6 5 B: 1 1 1 1 1 1 1 1 1 1 Same procedure (A=constructed,B=10d6,xchg A <=> B if another d6 is >3), but this time I clearly don't need to explain how the constructed sequence was constructed. The adversary will sometimes get it wrong because 10d6 came up "1 1 1 1 1 1 1 1 1 1" itself (or something equally-plausible like "6 6 6 6 6 6 6 6 6 6"), but they'll do much better than random guessing. Whereas being able to do better than random guessing against a CSPRNG/stream cipher means the cryptographic primitive is completely broken. (I'm not sure it's a direct break for a hash function, but it's still pretty bad.)