> Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? With high probability (over the distribution of possible dice-casts to d

> Can you contruct a sequence that an adversary CAN distinguish from a real dice-cast? With high probability (over the distribution of possible dice-casts to distinguish it from), yes: A: 6 4 3 2 1 4 5 1 6 5 B: 1 1 1 1 1 1 1 1 1 1 Same procedure (A=constructed,B=10d6,xchg A <=> B if another d6 is >3), but this time I clearly don't need to explain how the constructed sequence was constructed. The adversary will sometimes get it wrong because 10d6 came up "1 1 1 1 1 1 1 1 1 1" itself (or something equally-plausible like "6 6 6 6 6 6 6 6 6 6"), but they'll do much better than random guessing. Whereas being able to do better than random guessing against a CSPRNG/stream cipher means the cryptographic primitive is completely broken. (I'm not sure it's a direct break for a hash function, but it's still pretty bad.)