Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #186300

Re: One-line password generator

From Mario Castelán Castro <marioxcc.MT@yandex.com>
Newsgroups linux.debian.user
Subject Re: One-line password generator
Date 2017-09-02 16:40 +0200
Message-ID <ulhKy-45Y-5@gated-at.bofh.it> (permalink)
References <uhiYz-45R-39@gated-at.bofh.it> <ukVAm-6tL-9@gated-at.bofh.it> <ul3Rg-3zC-7@gated-at.bofh.it> <ul6vL-5tq-1@gated-at.bofh.it> <ul7rP-662-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 01/09/17 22:33, Zenaan Harkness wrote:
> On Fri, Sep 01, 2017 at 09:38:14PM -0500, Mario Castelán Castro wrote:
>> No. Entropy is the appropriate word. Please recall that “entropy” is
>> just a different scale
> 
> Use of the word "scale" is one example of things that lead people to
> use loose terms like "stretching of entropy", which, though useful in
> certain contexts, not only readily give rise to imprecise
> comprehension in the mind of someone who has no robust definition of
> the term, but is mathematically bogus on the face of it, unless one
> gets really really precise in each and every definition of every term
> in ones "turtles on turtles" stack of term.

When I mean entropy, I say “entropy”. I mean what I say. It is not my
guilt that other people misuse this word.

The entropy of the random distributions in the relevant cases here are
perfectly defined. From the fact that *YOU* do not understand the
definition does not follow that it is “mathematically bogus”.

> Now let's go to that first links second sentence:
> "The measure of information entropy [...]"
> 
> I am not mathematically literate enough to even properly parse that
> sentence!

Here (and through the rest of your message) you are admitting that you
do not understand the meaning of entropy in probability theory. Yet you
are making statements about entropy. This is intellectually dishonest,
to say the least.

>> According to my understanding, the output of /dev/urandom when reading
>> with my command will be truncate(ChaCha20(X)) where (X) is the aforesaid
>> 512-bit state and “truncate” is the function that returns the first 128
>> bits of its input. The processing with ChaCha20 and truncation skew the
>> distribution a bit, but this is negligible.
> 
> Interesting - I thought ChaCha was being used because it was such a
> good (non-skewing, suitably crypto-random mixing, reasonably
> performant) algorithm.

Indeed, when properly used, ChaCha20 is good as far as I can tell.

Roughly speaking, we are computing hash(X) to derive the 128 bits read
by my one-liner. Even though we assume that “X” is uniformly distributed
among a 384 bit space, we assume that “hash” will give a random result
for each input, independent of the value it gives for the rest of the
inputs. Thus with near certainty, some values will be more probable than
other values, but (by “the law of the large numbers”) only by a tiny
difference from what an uniform/unbiased distribution would require.

This is a phenomenon applicable to hash-like functions in general. It is
not a flaw of ChaCha20.

> Even theoretical attacks will undoubtedly focus on this skewing, if
> indeed ChaCha20, or the implementation of it in the kernel, is
> actually skewing.

This is an unjustified statement.

>> As a side note, I noticed that Linux uses weird constants in the
>> ChaCha20 input for the aforesaid CSPRNG: the ASCII text “expand 32-byte
>> k”. This looks like a bad choice, but I doubt that it has any security
>> impact in practice.
> 
> I assume the opposite - almost always, such constants will and do
> effect security of the algorithm, AIUI.

This is yet another unjustified assumption.

-- 
Do not eat animals; respect them as you respect people.
https://duckduckgo.com/?q=how+to+(become+OR+eat)+vegan

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 17:10 +0200
  Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-22 21:50 +0200
    Re: One-line password generator <tomas@tuxteam.de> - 2017-08-22 22:10 +0200
      Re: One-line password generator John Hasler <jhasler@newsguy.com> - 2017-08-22 22:50 +0200
        Re: One-line password generator Jude DaShiell <jdashiel@panix.com> - 2017-08-23 14:40 +0200
    Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 22:20 +0200
      Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 22:20 +0200
      Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-22 22:30 +0200
        Re: One-line password generator Glenn English <ghe2001@gmail.com> - 2017-08-23 22:40 +0200
      Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-23 00:40 +0200
        Re: One-line password generator Lck Ras <likcoras@riseup.net> - 2017-08-23 02:30 +0200
          Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-23 19:20 +0200
            Re: One-line password generator Lck Ras <likcoras@riseup.net> - 2017-08-24 03:00 +0200
        Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-23 17:20 +0200
          Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-23 19:00 +0200
            Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-23 20:00 +0200
              Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-23 21:20 +0200
                Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-24 01:10 +0200
                Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-24 19:50 +0200
                Re: One-line password generator David Wright <deblis@lionunicorn.co.uk> - 2017-08-25 03:00 +0200
                Re: One-line password generator Curt <curty@free.fr> - 2017-08-25 10:50 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-25 11:30 +0200
                Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-25 15:40 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-25 16:50 +0200
                Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-25 18:10 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-25 19:20 +0200
                Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-25 20:10 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-25 20:50 +0200
                Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-25 21:00 +0200
                Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-25 19:00 +0200
                Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-25 19:00 +0200
                Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-25 19:20 +0200
                Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-25 20:20 +0200
                Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-25 19:20 +0200
    Re: One-line password generator Jape Person <japers@comcast.net> - 2017-08-22 22:20 +0200
      Re: One-line password generator Jude DaShiell <jdashiel@panix.com> - 2017-08-23 14:40 +0200
    Re: One-line password generator Mike McClain <mike.junk.46@att.net> - 2017-08-23 03:10 +0200
  Re: One-line password generator Teemu Likonen <tlikonen@iki.fi> - 2017-08-23 06:10 +0200
  Re: One-line password generator Aaron Toponce <aaron.toponce@gmail.com> - 2017-08-23 21:20 +0200
    Re: One-line password generator Greg Wooledge <wooledg@eeg.ccf.org> - 2017-08-23 21:30 +0200
      Re: One-line password generator Aaron Toponce <aaron.toponce@gmail.com> - 2017-08-23 21:40 +0200
        Re: One-line password generator Fungi4All <fungilife@protonmail.com> - 2017-08-23 22:50 +0200
          Re: One-line password generator Terence <terence.john@gmail.com> - 2017-08-23 23:40 +0200
  Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-26 20:30 +0200
    Re: One-line password generator Nicolas George <george@nsup.org> - 2017-08-26 20:40 +0200
      Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-26 21:10 +0200
        Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-27 16:00 +0200
    Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-26 21:20 +0200
      Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-27 16:00 +0200
        Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-27 17:10 +0200
          Re: One-line password generator Curt <curty@free.fr> - 2017-08-27 20:10 +0200
          Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-27 20:10 +0200
            Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-27 21:10 +0200
              Re: One-line password generator Andy Smith <andy@strugglers.net> - 2017-08-28 00:00 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-28 09:40 +0200
                Re: One-line password generator Curt <curty@free.fr> - 2017-08-28 11:40 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-28 12:10 +0200
                Re: One-line password generator Andy Smith <andy@strugglers.net> - 2017-08-28 13:50 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-28 15:20 +0200
                Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-08-29 04:40 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-29 09:10 +0200
                Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-08-29 10:50 +0200
                Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-08-29 11:00 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-29 12:50 +0200
                Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-08-29 13:00 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-29 14:30 +0200
                Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-08-30 03:50 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-30 12:40 +0200
                Re: One-line password generator Andy Smith <andy@strugglers.net> - 2017-08-29 14:10 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-29 15:00 +0200
                Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-08-30 03:50 +0200
                Re: One-line password generator Greg Wooledge <wooledg@eeg.ccf.org> - 2017-08-30 14:20 +0200
                Re: One-line password generator Gene Heskett <gheskett@shentel.net> - 2017-08-30 14:50 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-30 15:20 +0200
                Re: One-line password generator Gene Heskett <gheskett@shentel.net> - 2017-08-30 15:30 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-30 15:50 +0200
                Re: One-line password generator Gene Heskett <gheskett@shentel.net> - 2017-08-30 16:00 +0200
                Re: One-line password generator Greg Wooledge <wooledg@eeg.ccf.org> - 2017-08-30 16:10 +0200
                Re: One-line password generator Gene Heskett <gheskett@shentel.net> - 2017-08-30 18:50 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-30 16:30 +0200
                Re: One-line password generator Gene Heskett <gheskett@shentel.net> - 2017-08-30 20:10 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-30 23:00 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-09-01 10:40 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-09-01 10:50 +0200
                Re: One-line password generator Curt <curty@free.fr> - 2017-08-30 16:30 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-30 17:00 +0200
                Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-30 20:00 +0200
                Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-08-29 11:00 +0200
            Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-27 21:20 +0200
              Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-29 21:20 +0200
                Re: One-line password generator Reco <recoverym4n@gmail.com> - 2017-08-29 21:40 +0200
                Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-29 22:00 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-29 23:00 +0200
                Re: One-line password generator Curt <curty@free.fr> - 2017-08-30 10:50 +0200
                Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-30 12:40 +0200
                Re: One-line password generator Reco <recoverym4n@gmail.com> - 2017-08-30 00:00 +0200
                Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-31 21:10 +0200
                Re: One-line password generator Fungi4All <fungilife@protonmail.com> - 2017-08-31 21:20 +0200
                Re: One-line password generator Reco <recoverym4n@gmail.com> - 2017-08-31 21:40 +0200
    Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-27 04:20 +0200
      Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-08-27 16:00 +0200
        Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-27 16:40 +0200
  Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-09-01 17:00 +0200
    Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-09-01 21:50 +0200
      Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-09-01 23:50 +0200
        Re: One-line password generator Jude DaShiell <jdashiel@panix.com> - 2017-09-02 11:50 +0200
          Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-09-02 13:00 +0200
            Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-09-02 19:20 +0200
              Re: One-line password generator Jude DaShiell <jdashiel@panix.com> - 2017-09-02 20:30 +0200
              Re: One-line password generator "Thomas Schmitt" <scdbackup@gmx.net> - 2017-09-02 21:00 +0200
                Re: One-line password generator Brian <ad44@cityscape.co.uk> - 2017-09-02 22:00 +0200
      Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-09-02 01:50 +0200
    Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-09-02 01:50 +0200
      Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-09-02 04:40 +0200
        Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-09-02 05:40 +0200
          Re: One-line password generator Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-09-02 16:40 +0200
            Re: One-line password generator Zenaan Harkness <zenaan@freedbms.net> - 2017-09-04 01:10 +0200

csiph-web