Re: [Cfrg] Schnorr just as vulnerable to bad RNG

[David Jacobson <[e-mail]>]

On 7/25/14 7:09 AM, Bodo Moeller wrote:
> ... in practice, sometimes you *think* you have proper seeding when 
> you actually don't.
This is wandering off topic, but I'm going to mention it anyway. Entropy 
generation is a very tricky thing.  Unfortunately, there is far too much 
emphasis on estimating the entropy of a source based on long term 
averages of something.  The problem is that many sources have entropy 
dropouts.  In one system I'm aware of, entropy was collected from noise 
in a radio.  I got a pile of the raw entropy, and noticed that every so 
often there were long runs of zeros. My guess is that there were 
occasional powerful RF "clicks" that overloaded the front end RF 
circuitry, and until the system recovered from the overload, zeros were 
reported.  These dropouts were tiny compared to the overall data, maybe 
0.01%, so they would have negligible effect on any metric that does long 
averages.  But had a seed been grabbed right during a dropout, it would 
have been a cryptographic disaster. And 0.01% corresponds to about 13 
bits of security.

      --David Jacobson