🚀 go-pugleaf

In <1992Oct5.221733.27777@netcom.com>
rlglende@netcom.com (Robert Lewis Glendenning)
writes:
> There are two issues here: 1) The academic consideration of RNGs with
> "truely" random distributions and 2) The consideration of being able to
> predict the random number series.

	For the sake of accuracy:

	(1) is it statistically random?
	(2) is it predictable?

	if (1) is not true, the chances for (2) becoming
	true increase.  This is the academic argument.

	The pragmatic argument says it is possible to
	generate a stream for which (2) is true, without
	consideration for the truth of (1).  But the fact
	is that if (2) is true, you can bet that (1) is
	likewise.  It won't be an accident.

> All of the academic consideration of RNGs I have seen focus on 1). 2) is
> necessary for using them in an encryption system. I have made my RNGs
> pretty unpredictable by running 32 different Additive Congruential Method
> RNGs, and only selecting one bit of each for each 32-bit number. I do so
> by randomly (another RNG) selecting the particular bit from each. Of course,
> this is computationally extremely expensive.

	You have 32 PRNG using different parameters (but same algorithm).
	You pick 1 bit from each, but in RANDOM order.  How random?  Is
	it another PRNG?

	You realize that if each PRNG is not cryptographically secure in
	its own right, the 32 are not any more secure, unless you have
	a "true" random source to pick your PRNG sequences.  In which
	case you don't need the 32 PRNGs.

> I believe that the OTP using itis pretty safe. However, safety can be improved
> by compressing the oriignal file and then distributing it randomly through
> a random number file.
> [ ... ]

	PRNGs can be usefull as key generators, if they are used
	to pick material from a non random source, but nevertheless
	unknown to the opposition.  Take one PRNG and use the result
	to index into a string of sufficient length (say, some book
	on CD).  As long as you don't divulge the source of your raw
	material (and change it often) you are in clover.  But: how do
	you distribute the key?  Do you phone your covert correspondant
	and tell him to go buy the CD?  Aside from the annoying security
	considerations, can you be sure the two of you will get the exact
	same text (editions vary from country to country)?

	But why bother with PRNG's of you have access to long files
	you can share with your correspondants.  The files themselves
	are good enough as a source of key material.

	Suppose you have enough raw material to make two files.  For each
	character of each file generate a parity bit.  If the two bits
	are different use the byte from the first file, else use the
	byte from the second file.  Advance to next byte of each file.
	Or you could simply use the parity bits as your OTP key.
	These are just two samples of the many ways...



--
 Alain