7 ms·

Not sure that I'm disagreeing with you; but: Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? If you can't distinguish a s

Not sure that I'm disagreeing with you; but: Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? If you can't distinguish a spoof from the real article, then that blade has two edges. It's impossible to distinguish them, so the instruction in the pudding test that you are to make a sequence that is indistinguishable from a dice-cast is meaningless, because any sequence is indistinguishable from a dice-cast. If you ask people to do impossible things before breakfast, then it's not sensible to do an analysis of what they end up doing. It's a waste of time.

a1369209993 5y ago
> Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? With high probability (over the distribution of possible dice-casts to distinguish it from), yes: A: 6 4 3 2 1 4 5 1 6 5 B: 1 1 1 1 1 1 1 1 1 1 Same procedure (A=constructed,B=10d6,xchg A <=> B if another d6 is >3), but this time I clearly don't need to explain how the constructed sequence was constructed. The adversary will sometimes get it wrong because 10d6 came up "1 1 1 1 1 1 1 1 1 1" itself (or something equally-plausible like "6 6 6 6 6 6 6 6 6 6"), but they'll do much better than random guessing. Whereas being able to do better than random guessing against a CSPRNG/stream cipher means the cryptographic primitive is completely broken. (I'm not sure it's a direct break for a hash function, but it's still pretty bad.)