Re:Convert standard Geiger counter to RNG
by tptacek on Monday November 13, 2023 @05:38PM
(#38256356)
I mean this is true, but it's also true that every cipher can be trivially broken if its key leaks. Yes: you want to rekey regularly (and that's not complicated). But whatever circumstance allowed your state to leak in the first place is most probably repeatable by an attacker, so you likely have much bigger problems than PRNG design.
If you want to snipe at people for freelancing their own CSPRNGs, the better point to make is that people should be relying on the OS's secure random generator to the exclusion of everything else; there are systems security reasons to avoid userland CSPRNGs.
But I think for the most part these are just people enjoying working out how a CSPRNG works. Which, mazel tov!
Re:Convert standard Geiger counter to RNG
by stcredzero on Monday November 13, 2023 @07:53PM
(#38257444)
Certainly, but your proposed scheme does not feed entropy back into the stream cipher, it just offsets its output.
Which effectively introduces entropy into the output, as well as to the internal state of the stream cipher.
This can be trivially broken if the stream cipher key ever leaks.
This is a trivial restatement of how symmetric ciphers are supposed to work.
Certainly, but your proposed scheme does not feed entropy back into the stream cipher, it just offsets its output. This can be trivially broken if the stream cipher key ever leaks.
A better solution would combine (ideally securely hash) the stream cipher key with a relatively large (i.e. on the order of > 100 bits) number of bits.