Re: [Eligibility-discuss] On 3797 alternatives

[Michael StJohns <[e-mail]>]

Hi -

Verifiably random is somewhat of an oxymoron.   We can do statistical 
measurements of data streams, and come to conclusions about how close 
they meet a given criteria, but that’s a far cry from verifiable.  We 
can, using similar models usually prove a source to be non random even 
if we can’t label it as predictable, but the opposite is harder.

What I think we want is/are sources that meet some set of statistical 
tests for randomness and that are shown to be resistant to externally 
applied bias/interference.   The former is pretty simple - take the 
output and run it through the tests.

The latter is more about "trustworthiness" than "verifiable 
randomness".   WRT to the sources used to seed the last dozen or so 
selections, we assume the trustworthiness because of the nature of the 
sources and the fact that we combine a number of those sources, but I'd 
be hard pressed to say that any single given source is "verifiably 
random" in either meeting statistical tests or resistance to externally 
applied bias.

That said, the current model is probably good enough if we're willing to 
wait a few days for each result.

Moving on to drand and it's ilk. It should be pretty easy to show they 
meet the statistical tests. The sole question really to be answered is 
whether the source is trustworthy and resistant to being biased.  Given 
that drand is a co-generated random bit stream, I'd say that answer 
could be readily ascertained by anyone who wanted to look a bit.  Some 
of the other public sources might be a bit harder to verify.


Later, Mike


On Wed, May 31, 2023 at 18:01 Rob Sayre <[e-mail]> wrote:



    On Wed, May 31, 2023 at 2:31 PM Donald Eastlake <[e-mail]>
    wrote:

        On Wed, May 31, 2023 at 2:43 PM Rob Sayre <[e-mail]> wrote:
         >
         > I'm not really here to sell drand, but it does meet the
        requirements on paper: "the source is announced before the
        ceremony starts...".

        No, in my opinion it does not. The title of the document starts with
        "Publicly Verifiable ...". Perhaps I should change the name to
        "Publicly Persuasive...". Would a member of the public believe drand
        is as honest as a major government run lottery? I think not.


    I'm not sure what "publically persuasive" would mean. I don't really
    see why a "major government run lottery" would be more believable
    here, but it's of course totally subjective.


         > Presumably you'd pick a drand iteration number from the
        future, and use that. The draft is a little confusing in using
        stock tickers, because "Section 3.1: Sources of Randomness" of
        RFC3797* says not to do that...

        And that section gives specific reasons why not.


    Yes.


         > While I agree that entropy "sources exist", the debate here
        is guidance on picking a verifiable one.

        I think it needs to be not just mechanically verifiable but also
        persuasively random.


    Yeah, it can be taken pretty far, even aside from quantum computing:
    https://www.cloudflare.com/learning/ssl/lava-lamp-encryption/

    The penultimate section is my favorite:

    Do all Cloudflare offices have the lava lamp wall?
    ---
    The other two main Cloudflare offices are in London and Singapore,
    and each office has its own method for generating random data from
    real-world inputs. London takes photos of a double-pendulum system
    mounted in the office (a pendulum connected to a pendulum, the
    movements of which are mathematically unpredictable). The Singapore
    office measures the radioactive decay of a pellet of uranium (a
    small enough amount to be harmless).

    At the bottom there, you get "LavaRand"*, which covers "Randomness
    Mixing". I don't think the IETF really needs to purchase a
    double-pendulum for this task, though. This stuff is persuasively
    random, but not verifiable.

    thanks,
    Rob

    *
    https://blog.cloudflare.com/lavarand-in-production-the-nitty-gritty-technical-details/
    -- 
    Eligibility-discuss mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/eligibility-discuss