6 ms·

Interesting that he says, "If your password is not completely random (ie. generated with the help of dice or a computer random number generator), then you shoul

Interesting that he says, "If your password is not completely random (ie. generated with the help of dice or a computer random number generator), then you should assume that your password is already broken." 1) When he says "dice" is he talking about physical dice or something, or is there some protocol called dice that I am not aware of? 2) I feel like even though a computer generated random string isn't completely random, that it could still be effective. Could someone elaborate on this a little bit more? What if you do tricky things like concatenate multiple random strings together? What about functions like urandom (I'm pretty sure that is truly random.)?

imaginenore 11y ago
Yes, he is talking about real dice. He comes from Bitcoin security point of view: don't trust anything. Dice, being physical objects outside of computer networks can be trusted to a pretty good degree. When it comes to creating something random on a computer, it's actually incredibly hard to guarantee randomness. Most RNGs are black boxes or are so non-transparent that they might as well be black boxes. You might have an idea how your *nix /dev/random works, but can you actually guarantee your OS is not compromised? Can your guarantee your BIOS is not compromised? Can you guarantee that your hardware is not compromised? That's why if you want a truly secure Bitcoin cold storage, you generate a wallet offline using something like dice or coinflips (dice are quicker).
- Dylan16807 11y ago
  I don't quite follow your logic. You still need an airgapped computer to turn those random bits into a working address, don't you? Is there a way to do that by hand? Is it more likely that the RNG is compromised than the bitcoin software?
  - imaginenore 11y ago
    Yes, but you have eliminated one vector of attack - a faulty or compromised RNG. > Is it more likely that the RNG is compromised than the bitcoin software? 1) That's a weird question. It's not like they are mutually exclusive. Both are possible. Dice allows you to eliminate the RNG problems. 2) http://en.wikipedia.org/wiki/Random_number_generator_attack#Prominent_examples http://en.wikipedia.org/wiki/Random_number_generator_attack#...
    - Dylan16807 11y ago
      If I think the risk is high enough to worry about, I'm going to use a method that gets close to eliminating it. I'm not going to settle for only removing one vector.
      - imaginenore 11y ago
        So don't. Using an airgapped computer will not save you against against a compromised RNG (e.g. reduced entropy). Your computer-generated numbers might look random to you, but you can't really be sure.
        Dylan16807 11y ago
        >So don't. Isn't that my argument? Maybe I should try again to clarify my position. 'Just' an airgapped computer solves neither backdoored RNG nor backdoored bitcoin software. A trusted airgapped computer comes close to solving both. Using dice only gives me half a solution; why bother?
        imaginenore 11y ago
        Airgapped computer definitely solves the compromised software/firmware problem, because it can't send your private keys to the attacker.
        Dylan16807 11y ago
        Compromised software can do anything a compromised RNG can do and more. Especially with something finicky like asymmetric crypto.
M4v3R 11y ago
They probably refer to Diceware [1]. [1] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
Dylan16807 11y ago
Dice map trivially to alphabet+numbers, and you know there are no flaws in the generation. It doesn't have to be competely random, but when humans make up passwords they grossly overestimate the entropy levels; it's easier to say not to do it at all. Especially since the longer a password a human makes, the more likely they are to use shortcuts to gut the entropy, such as involving not only words but actual sentences. Biased random number sources are okay, but you have to understand the bias, and it's easier to use an unbiased source. urandom is nearly perfect (post-boot) so use that.
Buge 11y ago
That quote is not saying computer generated random numbers are bad. It is saying computer generated random numbers are good. (And human generated random numbers are bad.) If you simply use the C rand function that is bad. But he's assuming you're using something with real randomness, like urandom.

imaginenore 11y ago

Yes, he is talking about real dice. He comes from Bitcoin security point of view: don't trust anything. Dice, being physical objects outside of computer networks can be trusted to a pretty good degree. When it comes to creating something random on a computer, it's actually incredibly hard to guarantee randomness. Most RNGs are black boxes or are so non-transparent that they might as well be black boxes. You might have an idea how your *nix /dev/random works, but can you actually guarantee your OS is not compromised? Can your guarantee your BIOS is not compromised? Can you guarantee that your hardware is not compromised? That's why if you want a truly secure Bitcoin cold storage, you generate a wallet offline using something like dice or coinflips (dice are quicker).

Dylan16807 11y ago
I don't quite follow your logic. You still need an airgapped computer to turn those random bits into a working address, don't you? Is there a way to do that by hand? Is it more likely that the RNG is compromised than the bitcoin software?
- imaginenore 11y ago
  Yes, but you have eliminated one vector of attack - a faulty or compromised RNG. > Is it more likely that the RNG is compromised than the bitcoin software? 1) That's a weird question. It's not like they are mutually exclusive. Both are possible. Dice allows you to eliminate the RNG problems. 2) http://en.wikipedia.org/wiki/Random_number_generator_attack#Prominent_examples http://en.wikipedia.org/wiki/Random_number_generator_attack#...
  - Dylan16807 11y ago
    If I think the risk is high enough to worry about, I'm going to use a method that gets close to eliminating it. I'm not going to settle for only removing one vector.
    - imaginenore 11y ago
      So don't. Using an airgapped computer will not save you against against a compromised RNG (e.g. reduced entropy). Your computer-generated numbers might look random to you, but you can't really be sure.
      - Dylan16807 11y ago
        >So don't. Isn't that my argument? Maybe I should try again to clarify my position. 'Just' an airgapped computer solves neither backdoored RNG nor backdoored bitcoin software. A trusted airgapped computer comes close to solving both. Using dice only gives me half a solution; why bother?
        imaginenore 11y ago
        Airgapped computer definitely solves the compromised software/firmware problem, because it can't send your private keys to the attacker.
        Dylan16807 11y ago
        Compromised software can do anything a compromised RNG can do and more. Especially with something finicky like asymmetric crypto.

M4v3R 11y ago

They probably refer to Diceware [1]. [1] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html

Dylan16807 11y ago

Dice map trivially to alphabet+numbers, and you know there are no flaws in the generation. It doesn't have to be competely random, but when humans make up passwords they grossly overestimate the entropy levels; it's easier to say not to do it at all. Especially since the longer a password a human makes, the more likely they are to use shortcuts to gut the entropy, such as involving not only words but actual sentences. Biased random number sources are okay, but you have to understand the bias, and it's easier to use an unbiased source. urandom is nearly perfect (post-boot) so use that.

Buge 11y ago

That quote is not saying computer generated random numbers are bad. It is saying computer generated random numbers are good. (And human generated random numbers are bad.) If you simply use the C rand function that is bad. But he's assuming you're using something with real randomness, like urandom.