The purpose of RNGs in cryptography is that they generate an *unpredictable*
series of numbers; ie: a sequence which it is not possible to recreate
without precise knowledge of the conditions prevailing at the time they were
generated. The /dev/random device on Linux et al is an attempt to
facilitate this, by making use of microscopic variations in the timing of
various system events like keypresses and network interrupts. Few of these
sources would bear stringent analyses of their statistical randomness, but
they are highly unpredictable to a remote attacker, hence useful enough for
cryptographic purposes. Most purely numeric RNGs have the disadvantage that
they are highly predictable if the initial conditions are captured - the
OpenSSL weakness discussed here falls into this category; the ill-advised
patch removed almost all of the unpredictable components of the RNG seed,
leaving a very small keyspace.
Colm
On Fri, May 16, 2008 at 2:35 PM, Timothy Murphy <gayleard at eircom.net> wrote:
> On Friday 16 May 2008 12:31:02 pm Kenn Humborg wrote:
> > > You use the term "white noise" as though it has
> > > some precise mathematical definition.
> > > I think it is usually used just to mean a noise
> > > in which no pattern can be discerned.
> >
> > A white noise signal has a fourier transform of
> > a constant value. In other words, it's flat in the
> > frequency domain. In other other words, it's
> > got the same energy content in the same frequency
> > interval at all frequencies.
> >
> > For example, the energy content between 10Hz and 20Hz
> > will be the same as the energy content between
> > 10000Hz and 10010Hz.
> >
> > (Contrast this with pink noise, where the energy between
> > 10Hz and 20Hz, is the same as that between 1000Hz and
> > 2000Hz and between 2000Hz and 4000Hz, etc. Pink noise
> > it a bit more pleasant to listen to...)
> >
> > It's not mathematically obvious to me that a flat
> > frequency spectrum implies a completely random signal,
> > but it does seem likely. Is the Fourier Transform
> > one-to-one? If so, then there is only one possible
> > function that could have transform to a constant value.
> > Does that function have to be random?
>> 1) How do you get "white noise" in this sense?
> It seems to me almost certain that a sound or light source
> would NOT have a constant (or even continuous) frequency distribution.
>> 2) If you did have such a source, how would you convert it
> into a sequence of integers?
>> 3) The fact that every digit, or sequence of digits,
> appears with equal frequency in a series of integers
> does not show that the series is random.
>> 4) The discussion here has re-inforced my belief
> that the use of physical devices to generate random numbers
> is pie-in-the-sky.
>> It seems to be based on the belief that if you don't know
> what the next number is then it must be random.
>>>>> --
> Timothy Murphy
> e-mail: gayleard /at/ eircom.net
> tel: +353-86-2336090, +353-1-2842366
> s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland
> --
> Irish Linux Users' Group mailing list
> About this list : http://mail.linux.ie/mailman/listinfo/ilug> Who we are : http://www.linux.ie/> Where we are : http://www.linux.ie/map/>
--
Colm Buckley / colm at tuatha.org / +353 87 2469146
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
