DOCSLIB.ORG

Pseudo-Random Generators and Pseudo-Random Functions : Cryptanalysis and Complexity Measures Thierry Mefenza Nountu

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Pseudo-Random Generators and Pseudo-Random Functions : Cryptanalysis and Complexity Measures Thierry Mefenza Nountu Pseudo-random generators and pseudo-random functions : cryptanalysis and complexity measures Thierry Mefenza Nountu To cite this version: Thierry Mefenza Nountu. Pseudo-random generators and pseudo-random functions : cryptanalysis and complexity measures. Cryptography and Security [cs.CR]. Université Paris sciences et lettres; Université de Yaoundé I, 2017. English. NNT : 2017PSLEE064. tel-01667124v2 HAL Id: tel-01667124 https://tel.archives-ouvertes.fr/tel-01667124v2 Submitted on 12 Jul 2018 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. THÈSE DE DOCTORAT EN COTUTELLE de l’Université de recherche Paris Sciences et Lettres PSL Research University et de l’Université de Yaoundé 1 Préparée à l’École normale supérieure et à l’université de Yaoundé 1 Pseudo-Random Generators and Pseudo-Random Functions : Cryptanalysis and Complexity Measures École doctorale n◦386 Sciences Mathématiques de Paris Centre Spécialité : Informatique COMPOSITION DU JURY M. LAGUILLAUMIE Fabien Université Lyon 1 Président du jury M. VERGNAUD Damien Université Pierre et Marie Curie Institut Universitaire de France Directeur de thèse M. TONGA Marcel Soutenue par Thierry Université Yaoundé 1 MEFENZA NOUNTU Directeur de thèse le 28 novembre 2017 M. DUQUESNE Sylvain Université Rennes 1 Rapporteur Dirigée par M. RENAULT Guénaël Damien VERGNAUD ANSSI et Marcel TONGA Rapporteur M. FERREIRA ABDALLA Michel CNRS, DI/ENS, PSL Research University Membre de jury Mme. IONICA Sorina RESEARCH UNIVERSITY PARIS Université de Picardie ÉCOLE NORMALE SUPÉRIEURE Membre du jury Pseudo-Random Generators and Pseudo-Random Functions: Cryptanalysis and Complexity Measures Thierry Mefenza Nountu Thèse de doctorat dirigée par Damien Vergnaud et Marcel Tonga Abstract Randomness is a key ingredient in cryptography. For instance, random numbers are used to generate keys, for encryption and to produce nonces. They are generated by pseudo-random generators and pseudo-random functions whose constructions are based on problems which are assumed to be difficult. In this thesis, we study some complexity measures of the Naor- Reingold and Dodis-Yampolskiy pseudo-random functions and study the security of some pseudo-random generators (the linear congruential generator and the power generator on elliptic curves) and some pairing-based signatures based on exponent-inversion framework. We show that the Dodis-Yampolskiy pseudo-random functions is uniformly distributed and that a low-degree or low-weight multivariate polynomial cannot interpolate the Naor-Reingold and Dodis-Yampolskiy pseudo-random functions over finite fields and over elliptic curves. The contrary would be disastrous since it would break the security of these functions and of problems on which they are based. We also show that the linear congruential generator and the power generator on elliptic curves are insecure if too many bits are output at each iteration. Practical implementations of cryptosystems often suffer from critical information leakage through side-channels. This can be the case when computing the exponentiation in order to compute the output of the Dodis-Yampolskiy pseudo-random function and more generally in well-known pairing-based signatures ( Sakai-Kasahara signatures, Boneh-Boyen signatures and Gentry signatures) based on the exponent-inversion framework. We present lattice-based polynomial-time (heuristic) algorithms that recover the signer’s secret in the pairing-based signatures when used to sign several messages under the assumption that blocks of consecutive bits of the exponents are known by the attacker. — iii — Résumé L’aléatoire est un ingrédient clé en cryptographie. Par exemple, les nombres aléatoires sont utilisés pour générer des clés, pour le chiffrement et pour produire des nonces. Ces nombres sont générés par des générateurs pseudo-aléatoires et des fonctions pseudo-aléatoires dont les constructions sont basées sur des problèmes qui sont supposés difficiles. Dans cette thèse, nous étudions certaines mesures de complexité des fonctions pseudo-aléatoires de Naor-Reingold et Dodis-Yampolskiy et étudions la sécurité de certains générateurs pseudo-aléatoires (le générateur linéaire congruentiel et le générateur puissance basés sur les courbes elliptiques) et de certaines signatures à base de couplage basées sur le paradigme d’inversion. Nous montrons que la fonction pseudo-aléatoire de Dodis-Yampolskiy est uniformément distribué et qu’un polynôme multivarié de petit dégré ou de petit poids ne peut pas interpoler les fonctions pseudo-aléatoires de Naor-Reingold et de Dodis-Yampolskiy définies sur un corps fini ou une courbe elliptique. Le contraire serait désastreux car un tel polynôme casserait la sécurité de ces fonctions et des problèmes sur lesquels elles sont basées. Nous montrons aussi que le générateur linéaire congruentiel et le générateur puissance basés sur les courbes elliptiques sont prédictibles si trop de bits sont sortis à chaque itération. Les implémentations pratiques de cryptosystèmes souffrent souvent de fuites critiques d’informations à travers des attaques par canaux cachés. Ceci peut être le cas lors du calcul de l’exponentiation afin de calculer la sortie de la fonction pseudo-aléatoire de Dodis-Yampolskiy et plus généralement le calcul des signatures dans certains schémas de signatures bien connus à base de couplage (signatures de Sakai-Kasahara, Boneh-Boyen et Gentry) basées sur le paradigme d’inversion. Nous présentons des algorithmes (heuristiques) en temps polynomial à base des réseaux qui retrouvent le secret de celui qui signe le message dans ces trois schémas de signatures lorsque plusieurs messages sont signés sous l’hypothèse que des blocs consécutifs de bits des exposants sont connus de l’adversaire. — v — Acknowledgments La réalisation de cette thèse n’aurait pas été possible sans le support inconditionnel de certaines personnes dont je ne peux décrire ici en quelques mots le rôle capital qu’elles ont pu jouer pour me permettre d’arriver à cette fin. Ainsi, j’adresse de tout mon coeur mes remerciements aux personnes qui m’ont aidées, encouragées, motivées afin de permettre la réalisation de cette thèse et je m’excuse d’avance auprès de ceux que j’ai oubliés. Je remercie très chaleureusement mes directeurs de thèse Damien Vergnaud et Marcel Tonga d’avoir accepté d’encadrer cette thèse. Pendant ces trois années vous m’avez initié à la recherche, guidé dans mon travail, appris a être autonome, encouragé quand j’étais moins optimiste, énormément conseillé et je vous en suis très reconnaissant pour tout cela. Je voudrais remercier particulièrement Damien qui en plus de l’encadrement, a toujours été là pour m’aider lorsque j’avais des problèmes de visa et qui malgré parfois le fait que je sois au Cameroun, n’hésitait pas à travailler avec moi par Skype. Je le remercie également pour son aide pour l’obtention du financement qui m’a permis de terminer cette thèse dans des meilleures conditions. J’adresse mes sincères remerciements à David Pointcheval qui m’a accueilli dans l’équipe Crypto de l’ENS et mis à ma disposition tout le matériel nécessaire pour la réalisation de ce travail. Je remercie de tout coeur Sylvain Duquesne qui m’a mis en contact avec Damien et qui m’a invité en France pour la première fois en 2013 afin de discuter d’un éventuel sujet de thèse avec Damien. Rapporter une thèse n’est pas toujours une chose facile car cela nécessite de la volonté, du temps et de la disponibilité. Ainsi, je voudrais remercier mes deux rapporteurs Sylvain Duquesne et Guénaël Rénault pour avoir lu attentivement et commenté cette thèse. Je témoigne aussi ma gratitude envers les autres membres de jury Michel Abdalla, Guillaume Laguillaumie et Sorina Ionica pour avoir accepté de faire partir de ce jury de thèse. Je voudrais remercier tous les membres de l’équipe Crypto de l’ENS, avec qui j’ai discuté et passé des moments très agréables lors des pauses cafés ou des évènements au laboratoire : Michel Abdalla, Balthazar Bauer, Sonia Belaïd, Fabrice Benhamouda, Florian Bourse, Céline Chevalier, Jérémy Chotard, Mario Cornejo, Edouard Dufour Sans, Angelo De Caro, Geoffroy Couteau, Rafaël Del Pino, Aurélien Dupin, Pierre-Alain Dupont, Pooya Farshim, Houda Ferradi, Pierre-Alain Fouque, Georg Fuchsbauer, Romain Gay, Dahmun Goudarzi, Aurore Guillevic, Chloé Hébant, Julia Hesse, Duong Hieu Phan, Louiza Khati, Pierrick Méaux, Michele Minelli, David Naccache, Anca Nitulescu, Michele Orrù, Alain Passelègue, Thomas Peters, David Pointcheval, Thomas Prest, Răzvan Roşie, Mélissa Rossi , Sylvain Ruhault, Adrian Thillard, Bogdan Ursu, Damien Vergnaud et Hoeteck Wee. Je remercie également l’équipe administrative du DI et le SPI, en particulier Lise-Marie Bivard, Isabelle Delais, Joëlle Isnard, Sophie Jaudon, Valérie Mongiat, Ludovic Ricardou et Benoît Speziari pour leur disponibilité, leur amabilité et leur professionnalisme quand j’avais besoin de quoi que ce soit. Je voudrais remercier tous les menbres de l’équipe ERAL du département de Mathéma- — vii — viii Acknowledgments tiques de l’université de Yaoundé 1 pour leurs
Load more

Recommended publications
  • An Enhanced Advanced Encryption Standard Algorithm
    ISSN 2278 – 3091 International Journal of Advanced Trends in Computer Science and Engineering (IJATCSE), Vol. 4 , No.4 Pages : 28 - 33 (2015) Special Issue of ICEEC 2015 - Held on August 24, 2015 in The Dunes, Cochin, India http://warse.org/IJATCSE/static/pdf/Issue/iceec2015sp06.pdf An Enhanced Advanced Encryption Standard Algorithm Kshyamasagar Mahanta1, Hima Bindu Maringanti2 1Department of Computer Science & Engineering, North Orissa University, India, [email protected] 2Department of Computer Science & Engineering, North Orissa University, India, [email protected] modifying the shift row phase involved . Similarly, in 2010, Abstract: In today’s world most of the communication is El-Sayed Abdoul-Moaty ElBadawy et. al. and in 2011, done using electronic media. Data Security plays a vital role Zhang Zhao et. al. have modified the standard AES in such communication. Hence, there is a need to protect data algorithm by modifying the S-box generation using 1-D from malicious attacks. Cryptography is the study of logistic chaos equation . In 2011, Alireza Jolfaei et. al. have mathematical techniques related to aspects of information identified such issues and modified the standard algorithm by security such as confidentiality, data integrity, entity modifying the S-box using the chaotic baker’s map equations authentication and data origin authentication. In data and . telecommunications, cryptography is necessary when Here, we have followed a different approach by encrypting communicating over any unreliable medium, which includes the key used in the AES algorithm. For the key encryption, any network particularly the internet. we have used the RNG algorithm, which gives a unique Advanced Encryption Standard (AES), also known as random key for each time of encryption.
    [Show full text]
  • A Practical Implementation of a One-Time Pad Cryptosystem
    Jeff Connelly CPE 456 June 11, 2008 A Practical Implementation of a One-time Pad Cryptosystem 0.1 Abstract How to securely transmit messages between two people has been a problem for centuries. The first ciphers of antiquity used laughably short keys and insecure algorithms easily broken with today’s computational power. This pattern has repeated throughout history, until the invention of the one-time pad in 1917, the world’s first provably unbreakable cryptosystem. However, the public generally does not use the one-time pad for encrypting their communication, despite the assurance of confidentiality, because of practical reasons. This paper presents an implementation of a practical one-time pad cryptosystem for use between two trusted individuals, that have met previously but wish to securely communicate over email after their departure. The system includes the generation of a one-time pad using a custom-built hardware TRNG as well as software to easily send and receive encrypted messages over email. This implementation combines guaranteed confidentiality with practicality. All of the work discussed here is available at http://imotp.sourceforge.net/. 1 Contents 0.1 Abstract.......................................... 1 1 Introduction 3 2 Implementation 3 2.1 RelatedWork....................................... 3 2.2 Description ........................................ 3 3 Generating Randomness 4 3.1 Inadequacy of Pseudo-random Number Generation . 4 3.2 TrulyRandomData .................................... 5 4 Software 6 4.1 Acquiring Audio . 6 4.1.1 Interference..................................... 6 4.2 MeasuringEntropy................................... 6 4.3 EntropyExtraction................................ ..... 7 4.3.1 De-skewing ..................................... 7 4.3.2 Mixing........................................ 7 5 Exchanging Pads 8 5.1 Merkle Channels . 8 5.2 Local Pad Security .
    [Show full text]
  • Analysis of Entropy Usage in Random Number Generators
    DEGREE PROJECT IN THE FIELD OF TECHNOLOGY ENGINEERING PHYSICS AND THE MAIN FIELD OF STUDY COMPUTER SCIENCE AND ENGINEERING, SECOND CYCLE, 30 CREDITS STOCKHOLM, SWEDEN 2017 Analysis of Entropy Usage in Random Number Generators KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF COMPUTER SCIENCE AND COMMUNICATION Analysis of Entropy Usage in Random Number Generators JOEL GÄRTNER Master in Computer Science Date: September 16, 2017 Supervisor: Douglas Wikström Examiner: Johan Håstad Principal: Omegapoint Swedish title: Analys av entropianvändning i slumptalsgeneratorer School of Computer Science and Communication i Abstract Cryptographically secure random number generators usually require an outside seed to be initialized. Other solutions instead use a continuous entropy stream to ensure that the internal state of the generator always remains unpredictable. This thesis analyses four such generators with entropy inputs. Furthermore, different ways to estimate entropy is presented and a new method useful for the generator analy- sis is developed. The developed entropy estimator performs well in tests and is used to analyse en- tropy gathered from the different generators. Furthermore, all the analysed generators exhibit some seemingly unintentional behaviour, but most should still be safe for use. ii Sammanfattning Kryptografiskt säkra slumptalsgeneratorer behöver ofta initialiseras med ett oförutsägbart frö. En annan lösning är att istället konstant ge slumptalsgeneratorer entropi. Detta gör det möjligt att garantera att det interna tillståndet i generatorn hålls oförutsägbart. I den här rapporten analyseras fyra sådana generatorer som matas med entropi. Dess- utom presenteras olika sätt att skatta entropi och en ny skattningsmetod utvecklas för att användas till analysen av generatorerna. Den framtagna metoden för entropiskattning lyckas bra i tester och används för att analysera entropin i de olika generatorerna.
    [Show full text]
  • Cryptgenrandom()
    (Pseudo)Random Data PA193 – Secure coding Petr Švenda Zdeněk Říha Faculty of Informatics, Masaryk University, Brno, CZ Need for “random” data • Games • Simulations, … • Crypto – Symmetric keys – Asymmetric keys – Padding/salt – Initialization vectors – Challenges (for challenge – response protocols) – … “Random” data • Sometimes (games, simulations) we only need data with some statistical properties – Evenly distributed numbers (from an interval) – Long and complete cycle • Large number of different values • All values can be generated • In crypto we also need unpredictability – Even if you have seen all the “random” data generated until now you have no idea what will be the random data generated next “Random” data generators • Insecure random number generators – noncryptographic pseudo-random number generators – Often leak information about their internal state with each output • Cryptographic pseudo-random number generators (PRNGs) – Based on seed deterministically generate pseudorandom data • “True” random data generators – Entropy harvesters – gather entropy from other sources and present it directly What (pseudo)random data to use? • Avoid using noncryptographic random number generators • For many purposes the right way is to get the seed from the true random number generator and then use it in the pseudorandom number generator (PRNG) – PRNG are deterministic, with the same seed they produce the same pseudorandom sequence • There are situations, where PRNG are not enough – E.g. one time pad Noncryptographic generators • Standard rand()/srand(), random ()/srandom() functions – libc • “Mersenne Twister” • linear feedback shift registers • Anything else not labeled as cryptographic PRNG… • Not to be used for most purposes…. Noncryptographic generators Source: Writing secure code, 2nd edition Source: http://xkcd.com/ PRNG • Cryptographic pseudo-random number generators are still predictable if you somehow know their internal state.
    [Show full text]
  • Additional Source of Entropy As a Service in the Android User-Space
    Faculty of Science Additional source of entropy as a service in the Android user-space Master Thesis B.C.M. (Bas) Visser Supervisors: dr. P. (Peter) Schwabe dr. V. (Veelasha) Moonsamy Nijmegen, July 2015 Abstract Secure encrypted communication on a smartphone or tablet requires a strong random seed as input for the encryption scheme. Android devices are based on the Linux kernel and are therefore provided with the /dev/random and /dev/urandom pseudo-random-number generators. /dev/random generates randomness from environmental sources but a number of papers have shown vulnerabilities in the entropy pool when there is a lack of user input. This thesis will research the possibility to provide additional entropy on the Android platform by extracting entropy from sensor data without the need for user input. The entropy level of this generated data is evaluated and this shows that it is feasible to extract randomness from the sensor data within reasonable time and using limited resources from the Android device. Finally, a prototype Android app is presented which uses generated sensor data as input for a stream cipher to create a pseudo-random-number generator in the Android user-space. This app can then be used as an additional source of randomness to strengthen random seeds for any process in the Android user-space on request. Additional source of entropy as a service in the Android user-space 1 Acknowledgements First I would like to thank my supervisor, Peter Schwabe. I started with a number of research projects that did not align with my interests and expertise.
    [Show full text]
  • Crypto 101 Lvh
    Crypto 101 lvh 1 2 Copyright 2013-2016, Laurens Van Houtven This book is made possible by your donations. If you enjoyed it, please consider making a donation, so it can be made even better and reach even more people. This work is available under the Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0) license. You can find the full text of the license at https://creativecommons.org/licenses/by-nc/4.0/. The following is a human-readable summary of (and not a substitute for) the license. You can: • Share: copy and redistribute the material in any medium or format • Adapt: remix, transform, and build upon the material The licensor cannot revoke these freedoms as long as you follow the license terms: • Attribution: you must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use. • NonCommercial: you may not use the material for commercial purposes. • No additional restrictions: you may not apply legal terms or technological measures that legally restrict others from doing anything the license permits. 3 You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation. No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material.
    [Show full text]
  • Random Number Generator
    Random number generator A random number generator (often abbreviated as RNG) is a computational or physical device designed to generate a sequence of numbers or symbols that lack any pattern, i.e. appear random . Computer-based systems for random number generation are widely used, but often fall short of this goal, though they may meet some statistical tests for randomness intended to ensure that they do not have any easily discernible patterns. Methods for generating random results have existed since ancient times, including dice , coin flipping , the shuffling of playing cards , the use of yarrow stalks in the I Ching , and many other techniques. "True" random numbers vs. pseudo-random numbers There are two principal methods used to generate random numbers. One measures some physical phenomenon that is expected to be random and then compensates for possible biases in the measurement process. The other uses computational algorithms that produce long sequences of apparently random results, which are in fact determined by a shorter initial seed or key. The latter type are often called pseudo-random number generators . A "random number generator" based solely on deterministic computation cannot be regarded as a "true" random number generator, since its output is inherently predictable. John von Neumann famously said "Anyone who uses arithmetic methods to produce random numbers is in a state of sin." How to distinguish a "true" random number from the output of a pseudo-random number generator is a very difficult problem. However, carefully chosen pseudo-random number generators can be used instead of true random numbers in many applications.
    [Show full text]
  • Crypto 101 Lvh
    Crypto 101 lvh 1 2 Copyright 2013-2017, Laurens Van Houtven (lvh) This work is available under the Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0) license. You can find the full text of the license at https://creativecommons.org/licenses/by-nc/4.0/. The following is a human-readable summary of (and not a substitute for) the license. You can: • Share: copy and redistribute the material in any medium or format • Adapt: remix, transform, and build upon the material The licensor cannot revoke these freedoms as long as you follow the license terms: • Attribution: you must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use. • NonCommercial: you may not use the material for commercial purposes. • No additional restrictions: you may not apply legal terms or technological measures that legally restrict others from doing anything the license permits. You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation. 3 No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material. Pomidorkowi 4 Contents Contents 5 I Foreword 10 1 About this book 11 2 Advanced sections 13 3 Development 14 4 Acknowledgments 15 II Building blocks 17 5 Exclusive or 18 5.1 Description .....................
    [Show full text]
  • Cryptographically Secure Pseudorandom Number Generator from Wikipedia, the Free Encyclopedia
    Cryptographically secure pseudorandom number generator From Wikipedia, the free encyclopedia A cryptographically secure pseudo-random number generator (CSPRNG) or cryptographic pseudo-random number generator (CPRNG)[1] is a pseudo- random number generator (PRNG) with properties that make it suitable for use in cryptography. Many aspects of cryptography require random numbers, for example: key generation nonces one-time pads salts in certain signature schemes, including ECDSA, RSASSA-PSS The "quality" of the randomness required for these applications varies. For example, creating a nonce in some protocols needs only uniqueness. On the other hand, generation of a master key requires a higher quality, such as more entropy. And in the case of one-time pads, the information-theoretic guarantee of perfect secrecy only holds if the key material comes from a true random source with high entropy. Ideally, the generation of random numbers in CSPRNGs uses entropy obtained from a high-quality source, generally the operating system's randomness API. However, unexpected correlations have been found in several such ostensibly independent processes. From an information-theoretic point of view, the amount of randomness, the entropy that can be generated, is equal to the entropy provided by the system. But sometimes, in practical situations, more random numbers are needed than there is entropy available. Also the processes to extract randomness from a running system are slow in actual practice. In such instances, a CSPRNG can sometimes be used. A CSPRNG can "stretch" the available entropy over more bits. Contents 1 Requirements 2 Definitions 3 Entropy extraction 4 Designs 4.1 Designs based on cryptographic primitives 4.2 Number theoretic designs 4.3 Special designs 5 Standards 6 NSA backdoor in the Dual_EC_DRBG PRNG 7 References 8 External links Requirements The requirements of an ordinary PRNG are also satisfied by a cryptographically secure PRNG, but the reverse is not true.
    [Show full text]
  • Cryptgenrandom()
    (Pseudo)Random Data PA193 – Secure coding Petr Švenda, Zdeněk Říha, Marek Sýs Faculty of Informatics, Masaryk University, Brno, CZ Need for “random” data • Games • Simulations, … • Crypto – Symmetric keys – Asymmetric keys – Padding/salt – Initialization vectors – Challenges (for challenge – response protocols) – … “Random” data • Sometimes (games, simulations) we only need data with some statistical properties – Uniformly distributed numbers (from an interval) – Long and complete cycle • Large number of different values • All values can be generated • In crypto we also need unpredictability – Even if you have seen all the “random” data generated until now you have no idea what will be the random data generated next Evaluation of randomness • What is more random 4 or 1234? – source of randomness is evaluated (not numbers). • Evaluation of source: – based on sequence of data it produces • Entropy – measure of randomness – says “How hard is to guess number source generates?” 4 I Entropy • FIPS140-3: “Entropy is the measure of the disorder, randomness or variability in a closed system. The entropy of a random variable X is a mathematical measure of the amount of information provided by an observation of X. “ • Determined by set of values and their probabilities • Shannon entropy: – Regular coin gives 1 bit of entropy per observation – Biased coin 99%:1% gives only 0.08 bits of entropy 5 I Entropy estimates • Difficulty of measurement/estimates – depends how we model the source i.e. set of values (and probabilities) we consider – single bits,
    [Show full text]
  • Pseudo-Random Number Generators
    Pseudorandom numbers generators Alexander Shevtsov May 17, 2016 Contents 1 Introduction 2 1.1 Real random data. 2 1.2 Pseudorandom data. 4 2 Pseudorandom number generators 5 2.1 Linear congruential generators . 5 2.2 Lagged Fibonacci generator. 6 3 Cryptographically secure PRNGs 7 3.1 Blum Blum Shub . 7 1 1 Introduction The need of random numbers occurs in different fields, for example in statistics, in cryptography, in computational mathematics1. We won't go into a detailed discussion of what randomness really is. An informal discussion suffices for our purposes. A good informal definition is that random data is unpredictable. A bit later we will state formal properties of a cryptographically secure pseudorandom number generator. Let's find out the difference between random data and pseudorandom data. 1.1 Real random data. Real random data can be obtained by measuring some physical characteristic of a physical process. The best means of obtaining unpredictable random numbers are done by measuring physical phenomena such as radioactive decay, thermal noise in semiconductors, sound samples taken in a noisy environment, and even digitised images of a lava lamp. However, few computers (or users) have access to the kind of specialised hardware required for these sources, and must rely on other means of obtaining random data. Modern approaches which don't rely on special hardware have ranged from precise timing measurements of the effects of air turbulence on the movement of hard drive heads [8], timing of keystrokes as the user enters a password, timing of memory accesses under artificially-induced thrashing conditions, and measurement of timing skew between two system timers (generally a hardware and a software timer, with the skew being affected by the 3-degree background radiation of interrupts and other system activity).
    [Show full text]
  • Crypto 101 Lvh
    Crypto 101 lvh 1 2 Copyright 2013-2016, Laurens Van Houtven This book is made possible by your donations. If you enjoyed it,please consider making a donation, so it can be made even better and reach even more people. This work is available under the Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0) license. You can find the full text of the license at https://creativecommons.org/licenses/by-nc/4.0/. The following is a human-readable summary of (and not a substitute for) the license. You can: • Share: copy and redistribute the material in any medium or format • Adapt: remix, transform, and build upon the material The licensor cannot revoke these freedoms as long as you follow the license terms: • Attribution: you must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use. • NonCommercial: you may not use the material for commercial purposes. • No additional restrictions: you may not apply legal terms or technological measures that legally restrict others from doing anything the license permits. 3 You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation. No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material.
    [Show full text]