-----BEGIN PGP SIGNED MESSAGE----- Hello, All! I was just thinking about how to generate random numbers, when I hit upon an interesting idea: If the internet is so huge and complex, why not, say, use the least significant bits of ping times from random internet hosts as seeds for a PRNG? (Practical Random Number Gen.) You could then break the resulting binary value into 128-bit blocks and modulus/xor each with a stream of random numbers taken from a keyboard timing. After all this, you could wash it with a secure symmetric cryptosystem such as idea in CBC mode. Any thoughts, comments? -olcay - -- "For he who lives more lives than one, |) Olcay Cirit -- olcay@libtech.com more deaths than one must die" (| http://www.libtech.com/olo2.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTh9pCoZzwIn1bdtAQGuDAGA1QM1KyGQ2i6n9LLF00HrVn7OvBftesA9 +Jsu4W3yZothdL1pFQLt2v5l9mjgTspW =2x/g -----END PGP SIGNATURE-----
The fact that something is complex does not mean your end of it can not be monitered. You need to discover random numbers from something very local to you, or your opponents can mess with your numbers. David Wagner posted something about how Mallet could muck with your RNG if it was based on incoming packet checksums, back in September. If you want good random numbers, track the mouse. Don't go looking outside your computer to things other computers do. Lastly, using collision-resistant hashing in considered preferable to encrypting information. Adam Olcay Cirit wrote: | If the internet is so huge and complex, why not, say, use | the least significant bits of ping times from random internet | hosts as seeds for a PRNG? (Practical Random Number Gen.) | After all this, you could wash it with a secure symmetric | cryptosystem such as idea in CBC mode. -- "It is seldom that liberty of any kind is lost all at once." -Hume
Olcay Cirit writes:
PRNG? (Practical Random Number Gen.)
Incidentally, deliberately overloading a widely-used acronym with a similar (?) but distinct meaning is a Bad Thing, unless you're just out to confuse people. Please, oh pretty please, consider reading some of the umpteen discussions of proposed random and pseudorandom sources in the list archives and FAQs and books.... -Lewis
participants (3)
-
Adam Shostack -
lmccarth＠cs.umass.edu -
Olcay Cirit