4 ms·

If a predictable PRNG is sufficient for wiping disks, why do we care that the data is random at all? How about writing 0, 1, 2, ..., 255, 0, 1, 2, ... to consec

If a predictable PRNG is sufficient for wiping disks, why do we care that the data is random at all? How about writing 0, 1, 2, ..., 255, 0, 1, 2, ... to consecutive bytes? Or -- generate 1 kb of good quality random data, and write the same 1 Kb repeatedly? It's not clear to me what we're trying to achieve in this scenario.

bsder 3y ago
Because it is conceivable that you could extract patterns from the underlying data because you know what the highly correlated, short-cycle writing pattern was. In reality, genuinely writing (as opposed to just pretending it was written which is a hazard on any modern storage) any single byte (even just all 0 or all 255) to every position on the disk seems to be more than sufficient to thwart even the NSA.
- tczajka 3y ago
  Isn't it also similarly conceivable that if you write a predictable PRNG sequence such the outputs of Mersenne Twister you could also potentially extract patterns? Mersenne Twister is essentially as predictable as a short cycle.
  - bsder 3y ago
    Correlating a short cycle is much more difficult than correlating a long cycle even if you have complete information about the long cycle. If the bits on the disk have a pattern, it is much more likely to repeat against a short cycle. However, as I pointed out, it's all pretty much moot. I've never seen anybody cough up evidence that a disk could be recovered after even a single write with merely zeroes. In fact, there was a competition and prize for a while that could be won if you could demonstrated reconstruction of a disk after even a single platter write. Nobody ever managed to claim it.
sneak 3y ago
What you just described is, in theory, just a really bad non-CS PRNG. In that sense we are in agreement that a CSPRNG is not necessary. To your point, a non-CS PRNG seeded with a static value isn’t “random at all”. This is why they are sometimes called DRBGs: deterministic random bit generators. You just described two such functions.
- tczajka 3y ago
  If this is sufficient, then this matches what I said in the article. I wrote that if you don't care about what numbers you get, don't bother with xoroshiro or Mersenne Twister, just use https://xkcd.com/221/ https://xkcd.com/221/.
- loeg 3y ago
  > This is why they [non-CS PRNGs] are sometimes called DRBGs CSPRNGs are also sometimes called DRBGs. Classically, "Dual_EC_DRBG" but also NIST SP 800-90A "(AES_)CTR_DRBG," which is what the Windows 10 kernel random device uses.

bsder 3y ago

Because it is conceivable that you could extract patterns from the underlying data because you know what the highly correlated, short-cycle writing pattern was. In reality, genuinely writing (as opposed to just pretending it was written which is a hazard on any modern storage) any single byte (even just all 0 or all 255) to every position on the disk seems to be more than sufficient to thwart even the NSA.

tczajka 3y ago
Isn't it also similarly conceivable that if you write a predictable PRNG sequence such the outputs of Mersenne Twister you could also potentially extract patterns? Mersenne Twister is essentially as predictable as a short cycle.
- bsder 3y ago
  Correlating a short cycle is much more difficult than correlating a long cycle even if you have complete information about the long cycle. If the bits on the disk have a pattern, it is much more likely to repeat against a short cycle. However, as I pointed out, it's all pretty much moot. I've never seen anybody cough up evidence that a disk could be recovered after even a single write with merely zeroes. In fact, there was a competition and prize for a while that could be won if you could demonstrated reconstruction of a disk after even a single platter write. Nobody ever managed to claim it.

sneak 3y ago

What you just described is, in theory, just a really bad non-CS PRNG. In that sense we are in agreement that a CSPRNG is not necessary. To your point, a non-CS PRNG seeded with a static value isn’t “random at all”. This is why they are sometimes called DRBGs: deterministic random bit generators. You just described two such functions.

tczajka 3y ago
If this is sufficient, then this matches what I said in the article. I wrote that if you don't care about what numbers you get, don't bother with xoroshiro or Mersenne Twister, just use https://xkcd.com/221/ https://xkcd.com/221/.
loeg 3y ago
> This is why they [non-CS PRNGs] are sometimes called DRBGs CSPRNGs are also sometimes called DRBGs. Classically, "Dual_EC_DRBG" but also NIST SP 800-90A "(AES_)CTR_DRBG," which is what the Windows 10 kernel random device uses.