News for hackers. Stuff that matters.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by ooopdddddd on Wednesday October 21, 2026 @03:31PM (#50186304)
There are several very practical reasons (and not emotional) reasons to expect that "4" is the result of bad implementation.

I can think any number of programming mistakes that will result in a supposed (pseudo-)random number generator to be be biased to very small numbers. I have made such mistakes myself.

By any reasonable estimate, the probability of randomly picking a number below 256 is MUCH smaller than the probability of someone having made a mistake.

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Wednesday October 21, 2026 @05:26PM (#50187879)
So you say that programming mistakes make small numbers more likely to be picked, and therefore seeing a small number is less likely than seeing a bigger number?

That doesn't make sense, does it?

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by echoangle on Wednesday October 21, 2026 @08:26PM (#50189497)
The claim is “if I generate a random number with equal distribution in a gigantic range and get a very tiny number, it’s more likely that there’s a mistake somewhere than that I just got this number randomly”.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Thursday October 22, 2026 @06:37AM (#50193554)
Which is... wrong?

If you generate a random number with equal distribution in a gigantic range, 0 is just as likely to happen as any other number in the range, right?

That's the meaning of "equal distribution".

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by echoangle on Thursday October 22, 2026 @10:07AM (#50195524)
I think you misunderstood the point.

In a working RNG, every number has equal probability.

But there's a probability <1 that the RNG is working as it should and a probability >0 that the RNG erroneously generates numbers that aren't equally distributed.

And because the range of possible numbers is so large and the probability of a mistake is not that tiny, a small result is more likely to be an error than a random result that happens to be small.

If I write a program to flip a coin and it generates heads 30 times in a row, is it more likely that this is just a random result or that I made a mistake in my programming?

One probability is 2^30, and the probability that someone makes an error resulting in this pattern is probably higher than 1/2^30.

Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Thursday October 22, 2026 @10:39AM (#50196038)
Right, ok I get it now!
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by creatonez on Wednesday October 21, 2026 @09:09PM (#50189858)
Huh? Smaller numbers are a smaller part of the space.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Thursday October 22, 2026 @06:38AM (#50193561)
So if I take a random number between 1 and 100, you think it's less likely that I pick 4 than, say, 83?
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by chopin on Friday October 23, 2026 @06:28AM (#50206820)
No but it's less likely to pick a number <10 than >50.
Re:Eight Bits of Trust; eMudhra's CA keys cracked in millise... by palata on Friday October 23, 2026 @06:54AM (#50207010)
So what? It's more likely to pick a number <10 than a number between 42 and 44.