4 ms·

> The question is: can you construct a sequence of dice-casts that an adversary can't distinguish from a real dice-cast? Yes, obviously: A: 2 4 4 3 5 2 3 6 4

by a1369209993 4y ago

> The question is: can you construct a sequence of dice-casts that an adversary can't distinguish from a real dice-cast? Yes, obviously: A: 2 4 4 3 5 2 3 6 4 2 B: 5 5 5 6 4 1 1 2 4 5 One is a real dice-cast with a d6 I had lying around. The other is the (100% deterministic) output of: echo 1651434259 $X | md5sum | grep -o '[1-6]' | paste -sd' ' for some X. Feel free to explain[0] how you are able to distinguish which is which. The real issue is that most people don't bother to produce random numbers in a way that's actually secure (which, to be fair, is rather tedious if you don't have a computer handy, and downright prohibitively impractical if you want to do it all in your head, so why would you bother?), either in the study or in general. 0: If you'd like a more black-box distinguishment, I can provide a longer list; obviously a adversary can get the right answer 50% of the time just by chance.

denton-scratch 4y ago
Not sure that I'm disagreeing with you; but: Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? If you can't distinguish a spoof from the real article, then that blade has two edges. It's impossible to distinguish them, so the instruction in the pudding test that you are to make a sequence that is indistinguishable from a dice-cast is meaningless, because any sequence is indistinguishable from a dice-cast. If you ask people to do impossible things before breakfast, then it's not sensible to do an analysis of what they end up doing. It's a waste of time.
- a1369209993 4y ago
  > Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? With high probability (over the distribution of possible dice-casts to distinguish it from), yes: A: 6 4 3 2 1 4 5 1 6 5 B: 1 1 1 1 1 1 1 1 1 1 Same procedure (A=constructed,B=10d6,xchg A <=> B if another d6 is >3), but this time I clearly don't need to explain how the constructed sequence was constructed. The adversary will sometimes get it wrong because 10d6 came up "1 1 1 1 1 1 1 1 1 1" itself (or something equally-plausible like "6 6 6 6 6 6 6 6 6 6"), but they'll do much better than random guessing. Whereas being able to do better than random guessing against a CSPRNG/stream cipher means the cryptographic primitive is completely broken. (I'm not sure it's a direct break for a hash function, but it's still pretty bad.)

denton-scratch 4y ago

Not sure that I'm disagreeing with you; but: Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? If you can't distinguish a spoof from the real article, then that blade has two edges. It's impossible to distinguish them, so the instruction in the pudding test that you are to make a sequence that is indistinguishable from a dice-cast is meaningless, because any sequence is indistinguishable from a dice-cast. If you ask people to do impossible things before breakfast, then it's not sensible to do an analysis of what they end up doing. It's a waste of time.

a1369209993 4y ago
> Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? With high probability (over the distribution of possible dice-casts to distinguish it from), yes: A: 6 4 3 2 1 4 5 1 6 5 B: 1 1 1 1 1 1 1 1 1 1 Same procedure (A=constructed,B=10d6,xchg A <=> B if another d6 is >3), but this time I clearly don't need to explain how the constructed sequence was constructed. The adversary will sometimes get it wrong because 10d6 came up "1 1 1 1 1 1 1 1 1 1" itself (or something equally-plausible like "6 6 6 6 6 6 6 6 6 6"), but they'll do much better than random guessing. Whereas being able to do better than random guessing against a CSPRNG/stream cipher means the cryptographic primitive is completely broken. (I'm not sure it's a direct break for a hash function, but it's still pretty bad.)