Re:All zeros in a bank card's CVC code
by Confiks on Thursday December 27, 2018 @09:32AM
(#18769606)
> meaningfully
The comment you replied to didn't include that condition, and I'd be reluctant to state some arbitrary percentage – as you conjure up 5% – to be 'meaningful'. A larger keyspace is strictly more secure against an attacker trying to guess the key.
Re:All zeros in a bank card's CVC code
by Dylan16807 on Thursday December 27, 2018 @09:58AM
(#18769749)
It's absolutely ridiculous to worry about the security difference between 9.966 bits of entropy vs. 9.964 bits of entropy.
You are also assuming the attacker is optimal. If the attacker has a bias that will reliably exist, and you counter-bias your generator, you can get better than 999/1000 odds against the average attacker.
This sort of argument gets misused a lot. If your entire list of exclusions is less than 5% of the keyspace, you have not meaningfully weakened security. The ability to detect when a number has been left at its default value is far more useful.
It's probably not worth excluding real customers to get that "is the number default?" check. But as a critique on the design of CVV, the system would be better if it never assigned 000.