News for hackers. Stuff that matters.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by nomel on Wednesday October 21, 2026 @11:09AM (#50182337)
> Essentially impossible if it were randomly selected.

You would say the same of any seed I gave you. You've just artificially assigned this number with some sort of emotional importance.

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by Quinner on Wednesday October 21, 2026 @11:28AM (#50182655)
If you cherry-pick that statement in isolation you're technically correct. But in practice the whole comment you're replying to is actually correct, in this case if you saw the number four, one would be correct in concluding that's unlikely and searching other low digit numbers, the proof of that is that it happened here.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Wednesday October 21, 2026 @05:23PM (#50187844)
I think they are right and you are wrong. If I understand properly you say:

"Playing roulette, in isolation after RED - RED - RED - RED - RED, there is not a higher chance of getting BLACK than RED in the next run. But in practice, one would be correct in concluding that it will probably be BLACK. The proof is that in our test, the next run gave BLACK".

Said differently, it was not particularly unlikely that the number would be 4. But maybe it got the attention of the person who decided to try assuming that it was a mistake, and they were indeed lucky.

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by gizzlon on Thursday October 22, 2026 @02:03AM (#50191721)
I think it's more like seeing RED - RED - RED - RED - RED and concluding the roulette is broken
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Thursday October 22, 2026 @06:41AM (#50193584)
My understanding is more that it's like seeing RED - RED - RED - RED - RED and wondering if the roulette is broken, testing it, and realising it is.

The hypothesis is "I see a small number, I can test if it is broken or not... oh it is". Could totally have been "no it's all good, just happened to be a small number".

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by eatkd on Wednesday October 21, 2026 @11:24AM (#50182600)
They had multiple keys and 7 of the keys were numbers less than 256.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by nomel on Wednesday October 21, 2026 @12:18PM (#50183476)
Yes, and that is what's statistically impossible. They said one cert.

> In this case one cert gets defeated and you go the odds of that number being that low are 2^-384.

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by ooopdddddd on Wednesday October 21, 2026 @03:31PM (#50186304)
There are several very practical reasons (and not emotional) reasons to expect that "4" is the result of bad implementation.

I can think any number of programming mistakes that will result in a supposed (pseudo-)random number generator to be be biased to very small numbers. I have made such mistakes myself.

By any reasonable estimate, the probability of randomly picking a number below 256 is MUCH smaller than the probability of someone having made a mistake.

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Wednesday October 21, 2026 @05:26PM (#50187879)
So you say that programming mistakes make small numbers more likely to be picked, and therefore seeing a small number is less likely than seeing a bigger number?

That doesn't make sense, does it?

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by echoangle on Wednesday October 21, 2026 @08:26PM (#50189497)
The claim is “if I generate a random number with equal distribution in a gigantic range and get a very tiny number, it’s more likely that there’s a mistake somewhere than that I just got this number randomly”.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Thursday October 22, 2026 @06:37AM (#50193554)
Which is... wrong?

If you generate a random number with equal distribution in a gigantic range, 0 is just as likely to happen as any other number in the range, right?

That's the meaning of "equal distribution".

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by echoangle on Thursday October 22, 2026 @10:07AM (#50195524)
I think you misunderstood the point.

In a working RNG, every number has equal probability.

But there's a probability <1 that the RNG is working as it should and a probability >0 that the RNG erroneously generates numbers that aren't equally distributed.

And because the range of possible numbers is so large and the probability of a mistake is not that tiny, a small result is more likely to be an error than a random result that happens to be small.

If I write a program to flip a coin and it generates heads 30 times in a row, is it more likely that this is just a random result or that I made a mistake in my programming?

One probability is 2^30, and the probability that someone makes an error resulting in this pattern is probably higher than 1/2^30.

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Thursday October 22, 2026 @10:39AM (#50196038)
Right, ok I get it now!
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by creatonez on Wednesday October 21, 2026 @09:09PM (#50189858)
Huh? Smaller numbers are a smaller part of the space.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Thursday October 22, 2026 @06:38AM (#50193561)
So if I take a random number between 1 and 100, you think it's less likely that I pick 4 than, say, 83?
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by chopin on Friday October 23, 2026 @06:28AM (#50206820)
No but it's less likely to pick a number <10 than >50.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Friday October 23, 2026 @06:54AM (#50207010)
So what? It's more likely to pick a number <10 than a number between 42 and 44.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Wednesday October 21, 2026 @05:24PM (#50187858)
I don't see why you would get downvoted for that. You're right.

It just happened that that particular number got the attention of a human, which was luck. But in terms of statistics, this number was not less likely than another one.