log☇︎
600+ entries in 0.287s
ave1: diana_coman, I'm reading through the eucrypt / RSA code and see that the 'get_random_prime' function will open and close the random number generator itself. I would like to open the entropy source once and reuse it, but maybe there is good reason to do it like this and I should not attempt to do it differently?
mircea_popescu: ideally you want to kill the "csprng" altogether and simply feed the entropy pool.
a111: Logged on 2018-02-09 20:16 pete_dushenski: ben_vulpes: fed fg to /dev/random then crossed my fingers and closed my eyes in hoping that gpg sourced entropy from there
pete_dushenski: ben_vulpes: fed fg to /dev/random then crossed my fingers and closed my eyes in hoping that gpg sourced entropy from there ☟︎
asciilifeform: found) only consumes roughly as many random bits as the size of the output primes, but we can show that its output distribution, even if it can be shown to have high entropy if the prime r-tuple conjecture holds, is also provably quite far from uniform... It is likely that most algorithms that proceed deterministically beyond an initial random choice, including those of Joye, Paillier and Vaudenay... ...or Maurer... exhibit similar d
asciilifeform: i mean ffs, koch dun even leave a knob to get ~key~ entropy trngistically.
asciilifeform: whereas my algo preserves the entropy of the penultimate bit.
asciilifeform: throws away whole bit of entropy in each factor, for nuffin
asciilifeform also wonders which, if any, 'dieharder' litmus, the item displayed in http://www.loper-os.org/bad-at-entropy/manmach.html is analogous to
asciilifeform: thing was built to avoid lying to itself and the operator re entropy. but that's only 1st step.
asciilifeform: whenever i work on 'entropy' i get the uncomfortable suspicion that i am working with a phlogiston
asciilifeform: ( the entropy that ~all~ of the litmuses have in common, is an imaginary entity... )
asciilifeform: it isn't clear to me why any such thing as 'distill the entropy' should be possible.
mircea_popescu: THERE CAN NOT BE SUCH A THING AS ORDERED ENTROPY!
mircea_popescu: think about it for a second, what's the aleph of entropy ?
asciilifeform: i'ma have to eat the 'not bias!' answer. even tho it leaves me without a clean analysis-flavoured picture of why successive rounds of faircoin improve entropy metrics across-the-board (regardless of what litmus is chosen)
asciilifeform: but also no faux-entropy
mircea_popescu: while getting entropy out ?
asciilifeform: 'I put together a Python-based client that can talk to Uber’s backends, to start harvesting OAuth2 tokens for entropy analysis and to see if there are any issues with their PRNG. What’s weird though is that the OAuth2 token doesn’t ever change, and I can’t find anything in the Uber developer documentation that deals with token expiration; literally the same token I was issued when I first created my Uber account for testing i
mircea_popescu: and suddenly the fg entropy debit is relevant : eulora server will be capable to produce iirc no more than 64 serpent keys/second per installed FG.
asciilifeform: ( will also point out, the lamps per se contribute ~0 entropy, arrangement is really ~same as hashwhitening output of camera static with the lens cap on )
asciilifeform doesn't expect to see a pill against this, other than he already obvious engineering margin of using respectable number of bits of entropy for whole thing
asciilifeform: ( she is using my sanitized gpg bignum. but i did not preserve koch's faux-rng atrocity ; so anything pertaining to entropy, is new )
mircea_popescu: as you'll reject the primes and end up with the same 2045 bits of entropy
asciilifeform: no reason to lose that 1bit of entropy.
mircea_popescu: plenty of entropy left as it is.
asciilifeform: they are the only ones you MUST set to 1 (i.e. lose the entropy of)
mod6: when you say 'lost bottom bits' worth of entropy -- you save the discarded bits and use them later', are you talking about the highest order 2 digits, and the lowest 1, saving their original lower-order half and using that?
asciilifeform: re the rsa key entropy, it is possible to trivially regain the lost bottom bits' worth of entropy -- you save the discarded bits and use them later as triggers for 'take nextprime(p) instead of p' and 'take nextprime(q) instead of q' . there may be other possible algos
a111: Logged on 2017-11-13 11:43 mircea_popescu: this is evidently a "loss" of entropy, in the sense that what is advertised (4096) differs from what is actually delivered (no more than 4090). i am of a good mind to start calling them 4090 bit keys tbh.
mod6: <+mircea_popescu> in other news : it was established in teh minigame torture rooms that in point of fact 4096 bit keys contain only 4090 bits of entropy at the very most (minus whatever koch-gpg manages to shave off in other ways). << uugh. every time we peel a layer back...
mircea_popescu: this is evidently a "loss" of entropy, in the sense that what is advertised (4096) differs from what is actually delivered (no more than 4090). i am of a good mind to start calling them 4090 bit keys tbh. ☟︎
mircea_popescu: in other news : it was established in teh minigame torture rooms that in point of fact 4096 bit keys contain only 4090 bits of entropy at the very most (minus whatever koch-gpg manages to shave off in other ways).
ag3nt_zer0: i think the confusion for me stems from hearing two different descriptions of brain wallets - one described as a way to, if i recall correctly, convert a privkey to a string of words to then be memorized and carried in brain over international borders or what not... and the other encounter I have with this concept is pete's method of generating a high entropy keypair and I am pretty sure I am answering my own question here but wou
ag3nt_zer0: it feels like a no-brainer but ahhh... if I use pete_dushenski's high entropy wallet method, I only need the private key generated by the words right? I dont need to keep the words... seems obviously dumb when I write it but the redditards are throwing me off here
a111: Logged on 2017-09-02 00:04 mircea_popescu: asciilifeform seed is a combo of site-produced TRNG entropy and player-set (with defaults if playher doesn't feel like setting). you can change your portion at any time.
davout: BYO entropy, can't possibly hurt
asciilifeform: ( exercise #2 : show how many bits of input entropy are on avg. discarded by koch generator. )
a111: Logged on 2016-12-24 01:46 asciilifeform: mircea_popescu: all schemes where the transform is of 'payload itself' and 0 entropy, suffer from immediate 'penguin problem', https://blog.filippo.io/content/images/2015/11/Tux_ecb.jpg .
a111: Logged on 2017-11-03 19:26 vlad56324: but if i generate entropy with my paper + pen, am i on the safe side or still intel can theoretically fuck me?
vlad56324: but if i generate entropy with my paper + pen, am i on the safe side or still intel can theoretically fuck me? ☟︎
cruciform: gotcha, so how should one convert his entropy to BTC private keys?
cruciform: http://www.contravex.com/2014/03/14/on-making-high-entropy-bitcoin-paper-wallets/ is this still the way to go?
mircea_popescu: very literally true, too. the act of fermentation as a thermodynamic process is correctly modelled as an increase in entropy ie exactly "that way lies demonology"
mircea_popescu: which is what i mean by "entropy work". $value-of-entropy work.
jhvh1: mircea_popescu: Szilard engine - Wikipedia: <https://en.wikipedia.org/%3Ftitle%3DSzilard_engine%26redirect%3Dno>; Entropy in thermodynamics and information theory - Wikipedia: <https://en.wikipedia.org/wiki/Entropy_in_thermodynamics_and_information_theory>; Szilard's engine – Powered by Knowledge – The Quantum and ...: <http://www.quantumcomplexity.org/tutorials/knowledge-is-power-the-energy-cont
mircea_popescu: asciilifeform "if one built a cylinder with independent pistons and a partition, and put a single molecule in, and knew on which side it found itself, that one could extract entropy work out of the assemblage!"
mircea_popescu: asciilifeform seed is a combo of site-produced TRNG entropy and player-set (with defaults if playher doesn't feel like setting). you can change your portion at any time. ☟︎
Barbarossa_: fwiw I've never heard a player even ask how they generate the entropy
Barbarossa_: Pokerstars, the largest site, uses a semi-transparent mirror for entropy
Barbarossa_: don't get me wrong: I'm mostly just trying to wrangle for an even cheaper implementation of gold standard entropy (despite not being a joo)
asciilifeform: this approach actually extracts the very low bit rate of entropy available from the muscle of the meat.
mircea_popescu: entropy poor machine is definitionally not supposed to rsa
PeterL: well, on entropy poor machine it would be slow, wouldn't it?
asciilifeform: PeterL: the 'cryptography komyoonity' derps didn't do it 'because slow', but because entropy-poor machine
asciilifeform: mircea_popescu: there's something to be said for 111111.....1 (max hamming weight), and there's something else to be said for max-entropy
mircea_popescu: entropy only half the issue there.
mircea_popescu: http://btcbase.org/log/2017-08-10#1696685 << it's cheap in the sense making your shoes by hand is cheap. it can be fun, but that's as far as it goes. leaving aside problems of how much a pair of aluminum, ruby or w/e dice cost (ie, GOOD dice), a throw provides you with a few bit's worth, FG spits out kB's worth per second. on a per-entropy-bit cost, figuring in capital goods, salary for the thrower, etcetera, FG is about 5 de ☝︎
edivad: at these times porn industry should have generated enough pornstar name entropy
asciilifeform: and not simply 'reducing entropy', but introducing a relationship between all of them
edivad: using deterministic shit, I'm reducing the entropy of my keys, correct?
edivad: basically, i recently learned how to generate private keys with a D16 + paper and pencil, and i thought that was a great way to have low cost true entropy
a111: Logged on 2016-08-18 12:32 mircea_popescu: asciilifeform since we're on this btw, the way i want tmsr-rsa key generation to work is as follows : a contains a number of entropy bytes specified by user in tmsr-rsa.conf read whenever tmsr-rsa.conf specifies (such as urandom); b contains a base-tmsr string specified by user. c = base-tmsr(a).b ; p = nextprime(cut(sha512(c),257)) ; process is repeated for q = nextprime (cut(sha512(c'),258));
PeterL: in " n / e^2 bits of entropy ", what are n and e, the key modulus and exponent?
mircea_popescu: and since we're apparently doing rsa likbez : if r used in padding above contributes less than n / e^2 bits of entropy to the final, padded message, coppersmith has a few words to tell you.
mircea_popescu: you mean, you had a boxed fg running and it produced 20GB of entropy so far and you can't detect anything more or less than with an unboxed FG ?
mircea_popescu: "i will derive my entropy from physical processes nearby!" "o aren't you cute"
mircea_popescu: now this is interesting. there is no... state machine entropy tester ? ynot!
asciilifeform: but rather tests a proposed test of entropy.
asciilifeform: as i understand, this doesn't test entropy
mircea_popescu: the whole discussion is, given a stream of perfect entropy, how to construct known-degree-of-badness out of it.
mircea_popescu: asciilifeform no that's exactly what we're doing. controlledly-bad-level entropy.
asciilifeform: the possibly paradoxical answer, afaik, is there does not actually exist such a thing as good entropy. only bad and worse.
mircea_popescu: asciilifeform there is that, yes. but we're doiong this for instrumentation in teh lab not for any other purpose. it's a tracer for entropy, like the shit they make you swallow to see your stomach.
mircea_popescu: in a sense. it has multiple utilities, it allows you to try and guess (numerically) whether for instance better entropy or more passes are useful for rabin miller
mircea_popescu: then we feed it into entropy-dependent processes (say the rabin miller test, as discussed yest) and see what comes out.
mircea_popescu: M' is now a "known low entropy bitfield". we know it to have degraded by 100/1Mb or w/e the case may be
mircea_popescu: it degrades the entropy of M' so obtained.
a111: Logged on 2017-07-10 19:50 mircea_popescu: which incidentally brings us to a very workable and very useful tmsr definition of entropy quality : take a FG string. flip a number of consecutive bits to 1. the result is your entropy quality, such as 100/1mb if you flipped 100 bits.
mircea_popescu: ben_vulpes here's a high pay grade question for you : of the two models of "controlled de-entropy" i spawned in a week, specifically a) count of randomly placed flipped bits, as in the discussion with you re that and b) string of randomly initiated, n bit long SET bits, as discussed in http://btcbase.org/log/2017-07-10#1681268 which does the bitcoin foundation regard as a better candidate for standardization as "the republic' ☝︎
mircea_popescu: which incidentally brings us to a very workable and very useful tmsr definition of entropy quality : take a FG string. flip a number of consecutive bits to 1. the result is your entropy quality, such as 100/1mb if you flipped 100 bits. ☟︎
mircea_popescu: asciilifeform that's another thing i would like : a graph of the relation of the m-r failure rate to the a) entropy quality and b) margin.
jurov: and cryptographers just invented -- entropy.
asciilifeform: 'Sources need to be statistically assessed. The quality of the entropy being produced needs to be estimated so that enough can be released to properly seed the RNG. The dieharder and TESTU01 suites are good but they both require prohibitively large amounts of random data to operate. NIST's SP800-90B tests seem to be statistically sound and have manageable data requirements....' << didjaknow!
a111: Logged on 2017-06-27 05:44 mircea_popescu: http://btcbase.org/log/2017-06-27#1674829 << your correct answer there was to say you use FG as a clock. which'd have totally sunk him, "my time comes in MB entropy chunks, ha-HA!"
mircea_popescu: http://btcbase.org/log/2017-06-27#1674829 << your correct answer there was to say you use FG as a clock. which'd have totally sunk him, "my time comes in MB entropy chunks, ha-HA!" ☝︎☟︎
asciilifeform: 'Uninitialized memory has been used as a source of entropy to seed random number generators in OpenSSL, DragonFly BSD, OpenBSD, and elsewhere.10 If accessing an indeterminate value is undefined behavior, however, compilers may optimize out these expressions, resulting in predictable values.' << bonus lol
asciilifeform: whereas harvesting actual entropy is painful, esp. if you want an engineering margin ( e.g. 2x in FG )
asciilifeform: mod6: elementarily, 'limited entropy', 'respectable mainstream' turd can put out whatever it wants, GB/s, of prng
mod6: <+asciilifeform> ^ d00d pushing 'onerng' over FUCKGOATS, with argument that the former 'is open source, mathematically verifiable, ...drivers for all current os, even openbsd...' while the latter 'no drivers, connection using obsolete medium - serial port, limited entropy' << limited entropy?! herp.
asciilifeform: ^ d00d pushing 'onerng' over FUCKGOATS, with argument that the former 'is open source, mathematically verifiable, ...drivers for all current os, even openbsd...' while the latter 'no drivers, connection using obsolete medium - serial port, limited entropy'
mod6: i went back to my linux output entropy files to see about the 'ff fd' thing; I'm really jammed up on openbsd. and that's a different side-quest we can discuss later. but now i'm wondering about the flow-control/output from collections done on linux
mod6: http://btcbase.org/log/2017-05-30#1663325 << so I should *not* be seeing a reoccurance of 'ff fd' throughout my entropy output files right? ☝︎
asciilifeform: ( pci etc would make moar sense for 'atomic' trng, as described in older thread, with the scintillator, because there your entropy extraction is limited more or less only by the clock speed of the take-off/debiaser and the dead time of the scintillator (1-5ns) )
asciilifeform: betcha the output has ~0 entropy also.
mod6: ... entropy
mod6: OK here are the results from a recollection of entropy (with 'fullblock') from FG #2: http://www.mod6.net/fg/fg-test/fg2.ent_run1.txt http://www.mod6.net/fg/fg-test/fg2.dieharder_run1.txt
mod6: I have re-run all three entropy collections from FG #1 with 'fullblock', here are the results: http://www.mod6.net/fg/fg-test/fg1.ent_run1.txt http://www.mod6.net/fg/fg-test/fg1.dieharder_run1.txt http://www.mod6.net/fg/fg-test/fg1.ent_run2.txt http://www.mod6.net/fg/fg-test/fg1.dieharder_run2.txt
Framedragger: oooh nice. /me yet to generate 1gb+ of entropy, will post when that's done
lobbes: (+mircea_popescu) mod6 i can't imagine lobbes 's have any issue lending the bot, once this is all in place. << yeah, no issue here. I'd be honored to have genuine entropy traded via bot