My last paragraph basically amounts to if any of the axioms used for constructing any crypto are false then all cryptography based on them is breakable and this is not specific to any implementation. If they're not false, proper implementation works, and implementation details are more important. In principle, just using a provably random TRNG to generate a seed and then using a properly implemented CSPRNG to generate numbers from the seed, as long as the seed is provably destroyed the numbers are indistinguishable from random numbers. This is not true of "randomness" generated by the human brain. "You'd rather not bet on that being true" is exactly right, theoretically a human could produce a truly random number, but the likelihood is very low that no predictable external influence went into that process compared to using noise generated by the chaotic universe.
What is that responding to? I thought I made the distinction between which one I was addressing pretty clear.
>But with regard to CSPRNGs, an implementation can have a flaw, and we have seen these sorts of things happen, a well known example is MD5, a hash function, which are similar in principle to PRNGs, was broken.
True, but my point was that the algorithm can itself be flawed, even if implemented correctly.
The point being, yes, you have Knightian uncertainty about the real factors that cause human-generated random numbers ... but you also have Knightian uncertainty about the existence of undiscovered flaws in your algorithm.
Yes, you're much less likely to run into the flaw if you're using a CSPRNG based on a high-entropy source, but in both cases it's true, or at least, impossible to rule out, that "there are biases in it, you just don't know there are."
Edit: And, FWIW, there aren't usable cryptosystems based on P=NP, which would actually be an improvement! Most are based on the far stronger assumption that certain "NP-intermediate" problems aren't feasibly solveable.
Isn't that true of CSPRNGs as well, though? One of them may have some huge flaw that allows it to be predicted, we just don't know what it is yet.
(I think you basically agree with this in your last paragraph?)
More generally, when we ask for a random number, what we're usually looking for is a number uncorrelated with some other number. For example, when you're doing an experiment, the purpose of the randomization is to ensure that you're not really capturing some other effect that was setting which parameters were placed together.
That is, if you're deciding to run the control vs test case because of subtle fluctuations in the room's lighting (that you're unaware are influencing you), then you may have no effect at all, but you accidentally pick up an effect which was really due to the lighting, not to the thing you're trying to test. Using a dice roll prevents this, not because of randomization per se, but because it reliably breaks other correlations that might seep into the experiment.
To the extent that a human randomizer meets that in one particular domain, it may be good enough (not that you were saying otherwise). It's just ... you'd rather not bet on that being true in any given case.