[lkml]   [2004]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: High Quality Random sources, was: Re: SecuriKey
Hash: SHA1

On Sunday 11 January 2004 7:39 pm, Stephen D. Williams wrote:
> Impossible? I think not. Some "mechanical" devices do exhibit true
> random capability, especially when enhanced by algorithmic means.
> To wit:
> Let me know if you can prove their methods don't provide a true "high
> quality" random source.
> I'd like to see their code as a module with an automatic test to make
> sure that the random source is high quality. In this case, that would
> mean making sure that the cap was not off the camera.
> sdw
just because it passes tests of entropy and probability doesn't make it
random. it just gets really really close. [hence pseudo-random]
Everybody knows that /dev/random isn't truly random (it's still a state
machine, dependent on a hash algorithm [chosen b/c they can take a
non-random source and make it 'LOOK' random], and you feed it with data
that is not totally predictable. BUT, there are still enough ways to
exploit it if you can control/influence the input). it just can pass
enough tests so that it can be used.

and that still doesn't answer the question of how one would use [such a
device] to 'generate a one time pad'. a one time pad must be possessed by
both parties that are communicating. and if you have a secure channel to
transmit an OTP, then you have one that can carry a message as well (most
commonly, an OTP is used with a time delay. there is a single time when a
secure channel is available. one [or both] of the parties brings it with
him/her when he/she travels.

so i'd believe that mebbe this Securikey could hold one... but, any USB
key-fob type device can.

I'm sure that someone else can be more knowledgeable on this than I, but
the general theory holds fast.

- --
- -
optimist, n.:
A proponent of the belief that black is white.

A pessimist asked God for relief.
"Ah, you wish me to restore your hope and cheerfulness," said God.
"No," replied the petitioner, "I wish you to create something that
would justify them."
"The world is all created," said God, "but you have overlooked
something -- the mortality of the optimist."
-- Ambrose Bierce, "The Devil's Dictionary"
Version: GnuPG v1.2.3 (GNU/Linux)


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:00    [W:0.056 / U:1.132 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site