Re:Linux Hardening Guide
by BelenusMordred on Thursday December 31, 2020 @06:11AM
(#25591639)
> (secret bits) xor (bits from /dev/xrandom) xor (bits from RDRAND)
> is very weak encryption.
It's as strong as the strongest source. This easily proven mathematically.
The mathematical result I think you are referring to is: any uniformly distributed random variable xored with any other independent random variable yields a uniformly distributed random variable. On the other hand, if we take the strongest random source in the universe, say X, and xor X with itself we get:
X xor X = 0
The result is just a sequence of zeros, which is not "as strong as the strongest source". In practice, people may take lots of different "random" sources as input to their random generators to make them "more" random. But if you don't take care to check if they are independent, you may have a problem.
Re:Linux Hardening Guide
by naniwaduni on Thursday December 31, 2020 @12:09PM
(#25594533)
On the contrary, the above computes exactly the identity cipher: your "ciphertext" is your plaintext.
Mathematical results will lead you to surprising conclusions if apply them in the wrong context!
(secret bits) xor (bits from /dev/xrandom) xor (bits from RDRAND)
is very weak encryption. But of course, there is no reason to believe RDRAND is dependent on any of the usual random sources.