Re: [Cfrg] Schnorr just as vulnerable to bad RNG

David Jacobson <dmjacobson@sbcglobal.net> wrote:

> This is wandering off topic, but I'm going to mention it anyway.

One place where it is on-topic and often discussed is Perry's
crypto list:
http://www.metzdowd.com/mailman/listinfo/cryptography

There is also a list specifically for RNG discussion:
http://lists.bitrot.info/mailman/listinfo/rng

> Entropy
> generation is a very tricky thing.  Unfortunately, there is far too much
> emphasis on estimating the entropy of a source based on long term averages
> of something.

It is possible to build an RNG without having to estimate average
entropy. Instead you can get a provable minimum on Nyquist
noise in a circuit from well-understood physics:
http://www.av8n.com/turbid/paper/turbid.htm

>  The problem is that many sources have entropy dropouts.  In
> one system I'm aware of, ... had a seed been grabbed right
> during a dropout, it would have been a cryptographic disaster.

"Doctor, it hurts when I do this." "Well, don't do that, then."

Do not grab seeds straight from the source; use an entropy
pool, stir in the source data, and generate output with a
cryptographically strong mixer. This is not foolproof, i.e.
not remarkably easy to get right, but there is hope. It is
safe if the total input entropy is adequate and the crypto
anywhere even close to its design goals.