Re: [Eligibility-discuss] NomCom selection Fwd: Notification for draft-eastlake-rfc3797bis-00.txt

[Paul Hoffman <[e-mail]>]

On 29 May 2023, at 15:51, Eric Rescorla wrote:

> Just to follow up on Joel's point, there are actually two issues in terms of
> randomness:
>
> 1. Getting enough different sources that there is a low risk one was
> compromised.
> 2. Getting enough entropy that the attacker cannot get a material advantage.

For #1, there is an exceptionally low chance that an individual or group could manipulate all the stocks in an index.

As I said in the previous message, #2 is covered in the Security Considerations. If I got that analysis wrong, I'm happy to hear about it.

> To see the second point, consider the case where there is only a single
> bit of unknown entropy. The attacker could then strategically
> add/delete/challenge
> candidate values until both values (0/1) produced good outcomes for them.

Completely true. But I don't see how that is relevant when there are at least 10 bits of randomness and the requirement that the name used is sensible.

> I don't have a calculation immediately to hand for how much is enough.
> Ideally
> you would like it to be much larger than N choose M where N is the number
> of candidate names and M is the number of chosen, but my (unverified)
> intuition is that it's sufficient to simply have the entropy be
> sufficiently large
> that it's not possible to search any significant fraction of the space. I do
> not believe that a single stock would be sufficient because there are a
> relatively small number of plausible values.

The proposed source in the draft is not a single stock: it is the combined value of 100 different stocks.

--Paul Hoffman