4 ms·
How about using a stream of true random numbers and putting it through a set of deterministic functions that "multiply" the quantity of random numbers. e.g. ma
by malandrew 13y ago
How about using a stream of true random numbers and putting it through a set of deterministic functions that "multiply" the quantity of random numbers.
e.g. make thousands upon thousands of functions, where the function names are sequential. Use the data itself to determine which of the functions will be called. Allow functions to call each other based on the random number values it calculates from its true random input. To figure out how much random data to produce, simply add an extra bit that is passed along to all the functions that indicates depth (how much show the true random data be processed before returning it to the program that needs a random number). This approach would produce a lot more random data that could only be determined if you knew the original true random data input and the amount of entropy that was required at the time since you'd need to know the depth used to know when to exit the functions.
- contingencies 13y agoErr, I think you'll find what you described is roughly the definition of a PRNG (though usually more mathematical in its verbiage). The problem is, we don't trust any particular PRNG. My question was, why not combine them so as to remove the need for absolute trust in any given PRNG.
- cdumler 13y agoWhen part of your system becomes flawed (part or whole), the whole can be attacked. Thus, adding more deterministic behavior doesn't add more randomness (i.e. more safety). Generally, when crypto falls down, it falls somewhat gracefully (i.e. there are a class of known attacks under certain particular situations.) As Crypto is an on-going war between those creating the security and those trying to break it, expect to have to change your crypto over time.
- contingencies 13y ago> When part of your system becomes flawed (part or whole), the whole can be attacked. This is the most concise and meaningful argument against the proposed approach thus far. Hats off.
- malandrew 13y agoI really need to get up to speed on cryptography. I've been a software developer for a while but haven't had a chance to get into it. Part of the reason is time, the other reason is that I haven't a clue where to start. I've heard about the books Security Engineering and Cryptography Engineering. Are they good books for someone new to all this?
- enoch_r 13y agoI'd recommend the Coursera crypto course: https://www.coursera.org/course/crypto https://www.coursera.org/course/crypto