Hot answers tagged

13

Hashing is a deterministic process which means that it can never increase the randomness. But of course it can decrease the randomness: if you hash a 200 bit random value with some hash algorithms which only outputs 160 bits (like SHA-1) then of course the resulting value can never have 200 bits randomness. But as long as the number of input bits is ...


9

The recommendation on the Diceware site is based on the assumption that the user is a non technical person. A dice has a very simple construction, and it's pretty obvious to any person how a dice works. It is much easier for a non technical person to verify that a dice throw will produce a random result, than for them to verify how an electronic PRNG ...


8

is swirling the mouse around in a little area sufficiently random to generate a good SSH-RSA key? Yes, it is. Nobody can predict how you move the mouse, and even if you are asked to copy a pattern, you won't be able to. You don't need to generate the random code elsewhere IF you can be sure that you Windows computer is not infected with malware capable of ...


7

I do not believe there are any research papers that describe the unpredictability of the neuromuscular system in the context of computer security and at the sample rates that are relevant, so I can't link the research papers you want. However, I can explain at least a few of the reasons why human movement is so stochastic and unpredictable. It all boils down ...


5

Almost all - if not all - smart cards have a true random number generator (TRNG) on it. Most often the TRNG depends on thermal noise or clock drift, but other entropy sources are possible. A more technical evaluation of this can be found e.g. here ("Sources of Randomness in Digital Devices and Their Testability by Viktor Fischer"). For a longer set of ...


5

It seems you could always need a bigger number. Not really. In theory perhaps, obviously there's always a bigger number, but you'll run into limits of physics pretty quickly. With a random 128 bit ID, you could store around an exabyte of IDs before running into problems with collisions. That's just storing the IDs, presumably you'll want to be storing data ...


4

As of 2019, the answer appears to by simply "we don't know". It is probably fine, though. This is how Puttygen generates keys: [A] quick look at the Puttygen source code indicates that it seems to generates private keys solely based on mouse movements. It fills an array with the time of mouse movement events in the even cells and the mouse position in ...


4

dd if=/dev/urandom bs=16 count=1 2>/dev/null | md5sum This is guaranteed to lose some entropy, but not much. The difficulty in attacking MD5 doesn't directly suggest the amount of loss, but merely tells us it is not zero. If I fall back on naïve construction, I find that the entropy loss is can be computed from the fixed point probability of 63.21%. ...


4

My concern is that my character selection is biased. Because 10 doesn't divide evenly into 256, the first 6 VALID_CHARS are slightly more likely to occur. The secret space is 10^32, but my generated secrets have less entropy than that. How can I calculate precisely how much entropy I actually have? Because not every digit is equally likely you can not ...


3

Math.random() (which supposedly generates ~32 bits of entropy No, it doesn't. Math.random is not a cryptographically secure random generator, so what it returns does not have any entropy. Entropy is a measure of how unguessable the output is. Since the output of Math.random is guessable in many circumstances (most easily, by having observed previous outputs,...


3

The Math.random() function in a browser's Javascript engine is not cryptographically secure. That is, it does not draw from a truly random source of bytes, and it follows a predictable pattern, even if most people would be unable to recognize that pattern. Simply using one semi-predictable sequences of numbers to set up a different semi-predictable ...


3

For reasons that are a bit involved, cryptographers use the min-entropy of a distribution as a measure of its strength: The min-entropy, in information theory, is the smallest of the Rényi family of entropies, corresponding to the most conservative way of measuring the unpredictability of a set of outcomes, as the negative logarithm of the probability of ...


3

First, if you take a hash of data containing in part random values, you would be better served by using directly random data, with the random_bytes function. For the usage of uniqid, you should first read its documentation. You are not using the "prefix" argument as it is meant to be used. To directly answer your question, you should avoid using uniqid ...


3

When Diceware was first proposed more than twenty years ago, many of the computers that people used did not have easy access to Cryptographically Secure PRNGs. And, as noted in other answers, most people are not in a position to determine whether or not the PRNG they are using is cryptographically secure. A Cryptographically Secure PRNG is, indeed, ...


3

Do not use an online source of entropy! If your system currently has insufficient entropy, then it will not be able to make a secure connection to random.org and any material you download from it will not be secret. Furthermore, you should not be using the blocking device anyway. It's perfectly fine to use /dev/urandom, no matter how low the entropy ...


3

Quantum computers are not magic. They can only accelerate a very specific class of problems in the so-called BQP complexity class. This includes integer factorization, which is why a cryptanalytic quantum computer is said to be capable of completely breaking RSA keys in polynomial time by utilizing the quantum Shor's algorithm. However, their ability to ...


2

As per this article it does not, but I arrived at this topic seeking confirmation of this article to begin with so take it for what it's worth. The relevant quote from the article is: OpenSSH does not implement the “random padding” feature of RFC4253 The secure shell protocol which says " the insertion of variable amounts of ‘random padding’ may help ...


2

Yes, but that's how you're getting randomness anyway. In Linux and most other operating systems, the exact time in nanoseconds that a key is pressed is recorded and injected into the entropy pool. This pool is used to seed the CSPRNG that powers /dev/urandom and other cryptographic random APIs. The similar /dev/random character device is what we describe as ...


2

This comes down to how much entropy is in mouse motion and how it is digested to give the key. I found this post that discusses experiments with mouse movements. It used a smooth mouse motion sampled at irregular intervals that are of course rounded to a whole pixel. It showed that this leads to a Gaussian distribution of acceleration with a few bits of ...


2

No, it's not safe at all. A passphrase would produce a deterministic key, but that would make this key vulnerable to brute-force and dictionary attacks. Besides, Fernet.generate_key() uses a CSPRNG (os.urandom()) which has an OS-specific randomness source and it does not accept a seed. It is possible to create deterministic but strong keys, using a ...


2

Could I query your "Solution for 1st problem": Solution for 1st problem: Both Desktop App and API share a Secret Key that the API will use to generate the JWT and the Desktop App will use to verify this JWT. The way you're implemented this now - if somebody recovers your secret from the desktop app, they could use this to create a new JWT token that both ...


2

Say, 256-bits of randomness and 256-bits of signature, is that any more secure than just using 512-bits of randomness? It is not any more secure. The best case scenario for the signed token is that the attacker don't know anything about what would be a proper signature. That effectively makes it a 512 bit ranom number from the perspective of the attacker. ...


2

Since without user-seeding, the JavaScript isaac implementation uses Math.random() as a seed, you would be better off using your own seed. You cannot derive security from an insecure input. If you replaced that call with a CSPRNG input like crypto.getRandomValues(), you would have a better output. But why not just use the built-in CSPRNG if you are using it ...


2

Fortunately, you don't have to choose. The xor function has the property that if you xor multiple independent source of entropy streams, the resulting output stream is going to have at least the entropy of the stronger source. Web Crypto CSPRNG (Crypto.getRandomValues()) is all you will need to generate crypto keys. But if you for some reason don't trust ...


2

Yes, more is more. Your terms are a bit off, as you can't generate entropy, and a Uint8 has 8 bits, but your basic assumption is correct. A larger seed will, in theory, produce less predictable results. In practicals terms, you would need to watch out that your input seed to the CSPRNG accepts the format you generate. For numbers, this is often limited to ...


2

It is very hard to evaluate the quality of a random password generator without knowing its underlying algorithms. The quality (the entropy) depends essentially on 2 elements: the number of possible combinations the equivalence of probability of different combinations The problem is that a random generator that would iterate over 10 millions random password ...


1

Other answers have already pointed out that Math.random doesn't generate secure random numbers. But even if you did have a source of secure random numbers, adding them together is not a good way to use them, because you lose most of the entropy. Suppose you have two high quality random integers a and b in the range 0 to 232−1 inclusive. Each one has 32 bits ...


1

A truly random seed is essential for any Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) to provide values that are useful in a security context. If a CSPRNG is not seeded, it does not provide any actual security at all. Modern operating systems store bytes from various interactions that are generally considered to be actually random, such ...


1

That is a pseudorandom number generator. So, yes, that's what all PRNGs do: Given a specific seed, always produce the same sequence of only seemingly random numbers. That happens by initializing the internal state from the seed, and then, every time a number is generated, updating the internal state and outputting a number. I've only superficially ...


1

When computer science papers speak about tape, it usually concerns some form of Turing machine. A Turing machine is a fictional machine which can read and write binary values from positions on an infinite string of tape. However, if this is the case the paper would definitely mention this or provide certain properties of the machine.


Only top voted, non community-wiki answers of a minimum length are eligible