Path: csiph.com!news.swapon.de!aioe.org!.POSTED!not-for-mail From: Kaz Kylheku Newsgroups: comp.programming Subject: Re: Researches in quantum computing seem to progress only extremely slowly Date: Wed, 2 Sep 2015 13:00:15 +0000 (UTC) Organization: Aioe.org NNTP Server Lines: 48 Message-ID: <20150902054403.661@kylheku.com> References: <20150901072207.925@kylheku.com> <20150901111251.317@kylheku.com> NNTP-Posting-Host: OGJi3KNpFOhM58UHZwXj0w.user.speranza.aioe.org X-Complaints-To: abuse@aioe.org User-Agent: slrn/pre1.0.0-18 (Linux) X-Notice: Filtered by postfilter v. 0.8.2 Xref: csiph.com comp.programming:5717 On 2015-09-02, Mok-Kong Shen wrote: > In my code PROVABLEPRIME > (http://s13.zetaboards.com/Crypto/topic/7234475/1/) there is no seed > to be input by the user at all. When the Python session starts, the > system employs the current time to seed its built-in PRNG. So each > time one uses the code to e.g. generate RSA keys, one gets a different > pair by chance. Certainly one could question the security of that from > an "exact" standpoint (I mean in the sense of proofs of pure math), The "exact standpoint" here is quite obvious and it is that a sample of the current time (even if it includes micro or nanoseconds from a high resolution timer, and not only the "seconds sine epoch" or whatever) simply has too few bits of entropy to generate good RSA keys. > but there is in "practical" crypto in general IMHO no way to take that > exact standpoint and yet have useful things done. Does e.g. AES have > an exact proof of its security? There is none, at least to my humble > knowledge. So if some crypto has no "exact proof of its security", then it's okay to implement it idiotically so that it is guaranteed to insecure? "This car wasn't put through rigorous crash tests, so I'm not going to bother wearing its seat belt!" > To repeat a few points of mine in another thread: (1) if a CSPRNG were > required in the implementation of Maurer's algorithm (detailed in HAC), It has already been explained to you that a CSPRNG is not in fact (specifically) required. What's required is enough bits of entropy from some good source. > the authors of HAC would have explicitly mentioned it according to the I'm pretty sure that HAC teaches that all randomly generated keys require sufficient entropy from a good source. (By the way, since you don't understand HAC, why should anyone waste their time giving you additional references?) > common style of writing in such contexts, (2) the algorithm given in > HAC of implementing a CSPRNG via RSA would barely have had any > practical sense (since one has a "need" of a CSPRNG "only" in > situations where one doesn't yet have one). It's been explained to you that there is no such "chicken or egg" problem. A CSPRNG needs a quality seed from a random source. If you have that, you can do the necessary key generation to bootstrap a PRNG which is based on RSA.