> it’s also almost impossible that I could influence the value ahead of time even if I had an insider at the NIST. Even if I’ve hacked into the NIST’s servers a

> it’s also almost impossible that I could influence the value ahead of time even if I had an insider at the NIST. Even if I’ve hacked into the NIST’s servers and tried to change that one value, the way that the values are chained will eventually make this tampering obvious. In the example, the decision is made based on whether the first digit is odd. Even if you can't directly manipulate the final random number, couldn't "an insider at the NIST" simply generate random numbers until the resulting hash matches the desired pattern, and then publish that number? DJB wrote an interesting blog post [1] discussing how a rogue entropy source can manipulate the output of a PRNG by emitting only the values that produce a certain pattern in the hash: > Here's an interesting example of an attack that can be carried out by this malicious source: > 1. Generate a random r. > 2. Try computing H(x,y,r). > 3. If H(x,y,r) doesn't start with bits 0000, go back to step 1. > 4. Output r as z. > This attack forces H(x,y,z) to start 0000, even if x and y were perfectly random. It's fast, taking just 16 computations of H on average. [1] http://blog.cr.yp.to/20140205-entropy.html http://blog.cr.yp.to/20140205-entropy.html