Random Number Generators, the Diehard Tests and the Mayor of Douglassville - Page 1
Forum section: electronics / general

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 26, 2016, 03:20:54 pm
content: So there is something I'd like to discuss about true random number generators and how they are tested for randomness but let me start with an anecdote:QuoteSo the mayor kept applying more and more constraints until his favourite, which is otherwise insignificant, stood on top of the list.Let's suppose now that we have the ideal random number generator. This ideal number generator [RNG from now on] produces random bits and puts them on a small page. Let's say our tiny pages are 3 by 3 bits, so they look something like this:Code:XOX XXO OOOXOO OXO OOXOXO XXO OXOIn theory our RNG could come up with 29or 512 different pages. However among those 512 there are some odd ones likeCode:XXX OOO XXX OOOXXX OOO XOX OXOXXX OOO XXX OOOSo if we fed the output of our Ideal RNG to some algorithm which tries to measure randomness it will fail because some of the pages are not random enough.On the other hand if we eliminate the pages that look structured we don't have a true RNG any more. We have reduced the number of pages significantly.In other words, if we apply enough constraints to our algorithms that look for randomness we may cause a flawed candidate to appear on top of the list.This whole train of thought was inspired by this video:I don't know the person but there is a chance he may be on EEVBlog.Thoughts?

author: CatalinaWOW
author_rank: Super Contributor
timestamp: January 26, 2016, 03:49:11 pm
content: Any statistical measure of randomness will give an estimate of how likely this sample is to be random. One constraint I favor is that this estimate tends to improve as the sample size grows by large factors. Among the traps to avoid is that those factors must not be related in any way to the generator of the simulated random numbers. It is a tough trap to avoid.

author: AF6LJ
author_rank: Unknown
timestamp: January 26, 2016, 04:01:35 pm
content: This is one of those pieces of science fantasy; there is no such thing as a random number, random act or anything random. Randomness exists only in the minds of people who cannot grasp chaotic events.Nothing in the universe is random, it only appears to be to those who cannot understand chaotic events.

author: dannyf
author_rank: Super Contributor
timestamp: January 26, 2016, 04:11:42 pm
content: "In other words, if we apply enough constraints to our algorithms that look for randomness we may cause a flawed candidate to appear on top of the list. "I have to say that I failed to follow your train of thoughts.But wanted to point out one thing: randomness is a probabilistic concept. All tests of randomness require a confidence level, as a result.So a truely random series may fail a randomness test and a truly unrandom series may pass the same test.The fact that you detect pattern by itself doesn't mean that the series is not random.Hope it helps.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 26, 2016, 04:26:49 pm
content: Quote from: AF6LJ on January 26, 2016, 04:01:35 pmWell, I guess you aren't a physicist... but if so, that's okay.I will give you this challenge: I have a sensitive amplifier connected to a resistor. If the resistor's noise is chaotic rather than Johnson-Nyquist noise, you should be able to come up with some ways of influencing its statistics externally (without otherwise changing its value, or changing the rest of the circuit).Indeed, this is one of those "million dollar challenge" kinds of things. I don't think it is, but perhaps it should be. I expect a suitable proposal, put forward to James Randi, could be added to the list. So there you have it, an easy million.Tim

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 26, 2016, 04:28:44 pm
content: Quote from: dannyf on January 26, 2016, 04:11:42 pmSuppose you have a list of names which are candidates for promotion. You want to manipulate the selection criteria in such a way that your name appears on top.So you keep adding more and more selection criteria until your name appears on top. The only thing you need to be careful about is to not eliminate your own name. Somewhat like playing 'Guess Who' in reverse.

author: AF6LJ
author_rank: Unknown
timestamp: January 26, 2016, 04:45:59 pm
content: Quote from: T3sl4co1l on January 26, 2016, 04:26:49 pmRandomness assumes there is no cause that can be predicted, I don't buy into that. We just are not smart enough yet to understand to the degree of prediction the mechanisms involved in seemingly random events.

author: dannyf
author_rank: Super Contributor
timestamp: January 26, 2016, 05:19:35 pm
content: "Suppose you have a list of na..."You may want to Google "distribution function".A random variable, having been transformed by distribution functions, is still random (with some exceptions).Such transformation function can favor particular values.What you are thinking about is a particular distribution function - uniform.Transformation is an important way to derive randomness of desired dostribution.

author: dannyf
author_rank: Super Contributor
timestamp: January 26, 2016, 07:57:58 pm
content: All that mumbo jumbo is to say that a distribution function that favors certain outcome produces truely random results if its input is truly random.What the op got confused on is randomness vs. Uniform distribution.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: January 26, 2016, 09:28:28 pm
content: There are many possible causes of OPs confusion. One being that there are a finite number of states for his generated pages. But that is no more a problem than a string of binary digits where there are only two states. Repitition of states, even a large number of sequencial repetitions is not proof of non-randomness, though it may reduce the likelihood that the sequence is truly random.The assertion that there is no such thing as randomness is just that - an assertion, with no proof or even basis other than hope. Introduction of chaos theory might imply a limit to the end states, but would not affect the random characteristic of the digits of irrational numbers. So there is such a thing as a random sequence, even if it represents nothing in the real world. If you buy into modern physics you still have no proof of the existence of randomness associated with the real world, but at least you do have a body of observations consistent with the possibility. Even at the heat death of the universe there will be random fluctuations of particle creation and destruction. The same stuff that Hawking used to show that black holes evaporate. This precludes an upper bound on the number of states of the universe, and at least is consistent with the possibility of truly random sequences.

author: IconicPCB
author_rank: Super Contributor
timestamp: January 26, 2016, 10:21:50 pm
content: Markov process and Entropy...

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 26, 2016, 10:26:10 pm
content: Quote from: dannyf on January 26, 2016, 07:57:58 pmSo two RNGs, one with random distribution and one without, can both produce truly random numbers and we can't tell the difference?

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: January 26, 2016, 10:33:05 pm
content: Hmm, problem is as old as mathematicsChi square test immediately comes to my mind:https://en.wikipedia.org/wiki/Chi-squared_test

author: TheCharels
author_rank: Contributor
timestamp: January 26, 2016, 10:46:33 pm
content: Humans are terrible at judging what is and is not random.If you do not think so try this experiment:1 - Write down a run of 50 event that have just two possible outcomes. Say heads and tails. Select the events to be as random as possible.2 - Then toss a coin 50 times and write down each result.3 - Ask some friends which result looks more random.

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 26, 2016, 10:49:28 pm
content: Quote from: IconicPCB on January 26, 2016, 10:21:50 pmI'm not familiar with this but seems relevant.So basically a Markof Process is some process for which you can't predict the next step even if you know all the previous outputs of the system. As long as you can't tell what the next step would be based on current data you are good to go.Sounds perfectly sensible but contradicts what @dannyf said.If a RNG doesn't have a uniform distribution this means that it has some sort of skew or 'color'. So if uniform distribution is like white noise a skewed RNG may produce output like a pink noise.So although you can't predict the next output of the pink RNG you can still distinguish a pink one among a million white ones. This sounds kinda serious.

author: MT
author_rank: Super Contributor
timestamp: January 26, 2016, 11:06:50 pm
content: The universe would not work (as so far we know it does) unless there are something that's random on whatever scale. Where are the electron? Well, that's what physic theorists say but they also say there are no universe but a multiverse but that one isflawed with probability numbers!....Who wants to live in a linear predictable world?

author: helius
author_rank: Super Contributor
timestamp: January 26, 2016, 11:29:19 pm
content: Randomness is entropy. Entropy is a physical attribute and so it requires access to a physical system: an algorithmic system can't have it, at best it is exposed through an oracle. But the algorithm system on its own, cannot possiblymeasureentropy. Only analyzing a closed physical system can do that.Example: your assignment is to calculate the randomness of a string of digits. The digits come from an oracle that is guaranteed to generate truly random data (let's say that it is a SQUID). Is there any way to measure how random this data is? Suppose you analyze the data and it fully passes your statistical test. But, unbeknownst to you, the data was copied to another computer at the same time you received it as input. You thought the entropy of the data was maximum because it satisfied a statistical randomness test. But in reality, a perfect copy of the same data existed inside another system; which means that your entropy is zero when analyzed in the closed system.But there are a lot of other abstract things that you need to consider. Let's say you accept the above argument, but still you think that you should be able to prove the negative: to show if the data isnotrandom. There should be a way to analyze the structure inside the stream to see if it has a pattern. It turns out that the most rigorous test is Kolmogorov Complexity, which is the shortest computer program that can generate the whole stream. It will tell you if the observed datacould have beenproduced by an algorithm, which would not be random. Two problems arise immediately: the first is that KC is incomputable, so it can never be calculated for longer than trivial short strings. The second is that an unbounded random string contains within it every possible finite substring, including all of the substrings that are the output of algorithms. So even though a finite random string doesn't compress using any algorithm that you know, the chances are high that it can be shortened by using its true KC program if that were ever discovered. Luckily KC is incomputable so it most likely never will be.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 27, 2016, 01:07:14 am
content: The interesting thing about noise, randomness, entropy and all that, is: it's not that noise is a lack of signal; indeed, it's anoversaturationofpure, unadulterated, superconvoluted information!What we generally call "information" is a modestly disordered state: it's more disorderly than nothingness (which is ultimately associated with emptiness, quietness: coldness!), but less disorderly than randomness.An unmodulated carrier frequency isn't very interesting: indeed, a perfectly pure sine wave carries only a few bits* worth of information.(*'Bits' in a colloquial sense. The frequency and amplitude are real numbers of finite accuracy, so can be expected to carry at least more than a few bits (in the digital sense) worth of real information. But beyond that, there is no information flow. It's energy, a one-time thing, not power, a flow.)Two examples, I think, would be pretty good illustrations:The history of early computing, and of digital communication devices, used a lot of interesting objects. For example, teletype machines used rotating cams to drive levers and gate signals; when these were used to select characters or print pixels from a radio transmission, a string or image resulted (e.g., telegraph, Hellschreiber, facsimile). The cams themselves, obviously enough, encoded the information necessary to decode the electrical signals. The patterns formed in stacks or drums or disks of these types of cams, often looked like white noise! Yet conspicuous order came back out of those signals and patterns.If you open a .EXE file in a hex editor, or view it in any number of arbitrary ways (ASCII, WAV, visual (you'll see runs and some patterns, but it'll mostly be colorful and messy), etc.), it looks pretty noisy. Obviously it contains patterns necessary for the computer to use, but how so isn't obvious. When you sit down and take a close look, however -- especially with the debugger -- it looks very much like a series of routines. You see the stack frame initialization and cleanup at the start and end of each function, and within those, there are operations on distinct areas of memory, usually relative to that stack frame, or to a passed-in pointer.Also, you typically see .EXE files getting compressed modestly by your typical compression routine (ZIP or otherwise). Which implies that even a rather simple compression algorithm was able to find and remove some order from the file. And indeed, for much the same reason that plain text compresses so well: "words" and "phrases" often repeat, like those stack frames, or of common manipulations of registers and memory areas before and after calling a function, or of common math expressions like addition and whatnot.Indeed, a compressor is a modestly good way to see how much lack of information there is in a file. By compressing plain text 85-90%, you've converted it to a high-information (nearly pure random) format.An ideal compressor might be able to do even more, but if one could exist, we would expect it to takeexponential timein deciding, essentially, what algorithm to use (or, indeed, perhaps create an algorithm from scratch through as-yet-unknown means). Which is not a very efficient process. Consider some encrypted data: the hash of "0000" might be a hugely complex number, even though the information it's encoding is quite low. Statistically speaking, the hash of a true random sequence is expected to look identical, even though it's encoding maximal information!So the point is, you can always make a low-information data stream look like more information (compression, encoding, scrambling, encrypting).But finding the low-information stream (if any) underlying a high-information data stream, is either a lossy process (i.e., you can simply strip away the bits you don't want: a rather dishonest and wasteful process!), or an extremely time-intensive one.Tim

author: dannyf
author_rank: Super Contributor
timestamp: January 27, 2016, 01:17:05 am
content: "So two RNGs, one with random distribution and one without, can both produce truly random numbers and we can't tell the difference?"First of all, there is no "random distribution" - all dostribution is no random, and deterministic. A uniform distribution function is one such example.One truly random series, when fed through two distribution functions will produce two random series. Those series may have different statistic attributes but they all are random.Hope it helps.

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 27, 2016, 01:53:41 am
content: Quote from: dannyf on January 27, 2016, 01:17:05 amMeant to say uniform distribution function, sorry.QuoteI don't know enough statistics to dispute that.Can a distribution function be implemented as a transfer function of an electronic circuit?

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 27, 2016, 02:11:00 am
content: Quote from: T3sl4co1l on January 27, 2016, 01:07:14 amNever thought of it that way. Kinda interesting to think about the implications. Suppose we tried to compress some OTP ciphers. One wouldn't expect the amount of compression to yield anything meaningful about the content, even if the input looked kinda structured.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 27, 2016, 02:41:54 am
content: Well, OTP is perfect in the sense that exactly one pad will give the exact answer, and that string is the length of the message, so no part of the message is broken by any part of the pad being broken. And for a binary string of length N, that's 2^N possibilities. And, if the OTP is generated by random data, the encoded data is expected to look true random, too.So the input to the compressor would look true random, almost regardless of the message being sent (the one exception being if the message happens to be correlated with the pad, which would be a silly abuse of cryptography).Tim

author: CatalinaWOW
author_rank: Super Contributor
timestamp: January 27, 2016, 05:17:45 am
content: Quote from: helius on January 26, 2016, 11:29:19 pmYour example breaks down at the limit. As the length of the string increases eventually there are not enough states in the universe to make two copies. Or to look at it another way, a universe which has exactly two strings in it, both identical, is not at maximum entropy.

author: helius
author_rank: Super Contributor
timestamp: January 27, 2016, 05:35:36 am
content: The how-many-angels-on-a-pinhead stuff (states in the universe? really?) doesn't interest me. In engineering practice the limiting factor is not a shortage of states. But it is important to understand that "random" is a single concept with different facets, depending on which system is being analyzed. A pseudorandom sequence with a long enough period can be designed to satisfy any finite statistical entropy test: if we are interested in pseudorandom sequence design, this is fine. If we are concerned with entropy for cryptology, it makes a pure statistical approach useless. We also need to be concerned with the physical system and its side channels.

author: AF6LJ
author_rank: Unknown
timestamp: January 27, 2016, 03:20:57 pm
content: Quote from: MT on January 26, 2016, 11:06:50 pmI don't buy into the "Universe was created by a random event" that for one thing is a cop out. Just admitting "We don't know the event that brought the Universe into being" is good enough.We don't know nearly enough to come to any reasonable conclusion regarding the creation of the Universe or most everything else such as what makes gravity work.All this discussion regarding so called randomness just proves my point. The concept of randomness is a construct used by man's simple mind to explain events that are far more complex than man and his simple mind can understand.Attributing something to a random event is no more realistic than our ancestors attributing the sun rise to a fictional god.

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 27, 2016, 03:29:45 pm
content: Quote from: helius on January 27, 2016, 05:35:36 amHear hear. We also need to consider supply chain integrity and complete verifiability at the point of use.

author: MT
author_rank: Super Contributor
timestamp: January 27, 2016, 06:47:28 pm
content: Quote from: AF6LJ on January 27, 2016, 03:20:57 pmWhatever you say mr God! Here is a toy, called double pendulum, for you to waste your advanced mind on! I'll take nap..

author: helius
author_rank: Super Contributor
timestamp: January 27, 2016, 06:57:05 pm
content: chaos is pretty much the opposite of randomness, because it is perfectly predictable based on accurate starting conditions. Otherwise there would be no animated gif for you to show, because every time the page loaded it would need to be different!

author: AF6LJ
author_rank: Unknown
timestamp: January 27, 2016, 06:57:55 pm
content: Quote from: MT on January 27, 2016, 06:47:28 pmThat is Miss GOD by the way.I am not equipped like you, my reproductive organs are on the INSIDE.

author: AF6LJ
author_rank: Unknown
timestamp: January 27, 2016, 06:59:05 pm
content: Quote from: helius on January 27, 2016, 06:57:05 pmIndeed.

author: MT
author_rank: Super Contributor
timestamp: January 27, 2016, 09:44:34 pm
content: Quote from: AF6LJ on January 27, 2016, 06:57:55 pmWhatever you say Miss/mr god'ess whatever , nobody are forcing you or helios to buy or believe anything,else why not contemplate over Tim's suggestion one more time, he addressed you specifically, here it is:Quote

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: January 27, 2016, 10:55:09 pm
content: I think I wont really gain anything if I know who is right.What do want to know however is do we have a method, that is experimental, theoretically correct and practically verifiable method to distinguish between an arbitrary pseudo random sequence and one that deemed to be truly random and generated by physical process such as radioactive decay?Suppose I have generated 2 random sets of numbers - one generated by (good, not naive) algorithm another by noise diode. I lost my code and all initial conditions and I don't know which set is which. How do I proceed?

author: dannyf
author_rank: Super Contributor
timestamp: January 27, 2016, 11:07:57 pm
content: QuoteRegardless of the nature of the signal sources, you can always change its statistics externally by feeding that signal through a "shaping" amplifier: could be a low-pass filter for example that will make the singal more red; a high-pass filter making it more blue; a windowed comparator would limit its range, .....

author: helius
author_rank: Super Contributor
timestamp: January 27, 2016, 11:16:57 pm
content: Quote from: Alexei.Polkhanov on January 27, 2016, 10:55:09 pmPseudorandom sequences all have a finite period. If you compare a long enough output they all start repeating eventually. That is the only theoretically correct difference.But, I am not sure if you mean that you know what PRNG algorithm may have been used. Only some are "cryptographically secure," CPRNGs. For the ones that are not, it is feasible to look at some output and deduce the seed, which can then be used to predict the remainder of the sequence. In this special case, you can distinguish it from true randomness.QuoteIf the noise diode output has not been whitened, it is likely to have stronger bias compared to a good pseudorandom generator.

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: January 27, 2016, 11:52:07 pm
content: Quote from: helius on January 27, 2016, 11:16:57 pmYes, if truly random sequence is very long chances that some combination of seed/PRNG algorithm will generate exactly same sequence it is very low.When I asked the question I did not mean it to be rhetorical. I was hoping for answer like - "there is an algorithm XXX, and also there is YYY" and a references to a web page or book where I can find it. I do have copy of "Art of Programming" and "Numerical Recipes" and few others on my shelf. They all seem to say that such tests are limited. Any mathematicians here - where are we on this problem? I am just curious.

author: timb
author_rank: Super Contributor
timestamp: January 28, 2016, 12:26:14 am
content: Quote from: MT on January 27, 2016, 09:44:34 pmWell, it's obvious that only men can create noise with their Johnson, since (most) women lack them. On the other hand, AF6LJ (and other bipedal carbon based life forms with internal reproductive organs) would add plenty ofhysteresis to the process.Hyster(o)-1. Uterus2. Hysteria (Literally: "Womb Panic")3. Later, after, following.

author: Brumby
author_rank: Unknown
timestamp: January 28, 2016, 01:57:57 am
content: People - Let me know when you've got a handle on the Lottery results.

author: AF6LJ
author_rank: Unknown
timestamp: January 28, 2016, 03:05:56 pm
content: Quote from: MT on January 27, 2016, 09:44:34 pmI think you miss the point;Randomness has always been a "catch all word" for processes who's complexity is beyond our understanding.Knowing this just puts everything in prospective.

author: zapta
author_rank: Super Contributor
timestamp: January 28, 2016, 04:08:06 pm
content: Quote from: HAL-42b on January 26, 2016, 03:20:54 pmThere is nothing special or odd about this combination. With real RNG It is likely like any other combination.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 28, 2016, 08:11:46 pm
content: I find information theory provides a perspective that ties things together nicely.We know from physics that all elemental processes are reversible. Why, then, should entropy increase?Suppose we have a system of interacting particles. Each particle can exchange some information with its neighbors, and so on. We shall define the system as having a temperature, so that there is an average energy in the system, and therefore there is information to exchange.This is necessary, because if the system were at absolute zero, then all particles would be in the ground state, and there would be no information to exchange.Because interactions are necessarily reversible, the essence of "information", is knowing that a given particle, or set of particles, are absolutely known to be in some state.Now, consider one particle. It has a given existing state. (If we're looking at, say, nuclear spins, then it might be spin-up or something.)If that state is mixed with a neighboring state, the result is an entanglement of those two states.In the new combined state, the fixed, known information (that the particle had a spin-up state) remains present. But after this step, you now must test two particles, and subtract the "interference" (the unknown state entangled with it) to measure the original state.If those new states mix with their neighbors, and so on, more and more individual states become entangled (and in more and more possible permutations), and more and more particles must be measured, and their interactions subtracted, in an ever more complex series of operations.Effectively, the kernel of information contained in any one particle, at any point in this state-transition diagram, diffuses outward as more (unknown) states interact with, and dilute, it.It is very difficult to explain a system like this without using chronological terms ("before", "after"), but this system can be described in abstract without any assumption of "time". You can simply have, for example, an array of variables in computer memory, and iterate a function on it. There is always a successor operation, and because the function is by definition reversible, there is always a predecessor operation, too. You can use either function on the array.But only one function, when iterated, will result in something that looks like "after".Indeed, the arrow of time, is uniquely, and necessarily, identified by being the direction in which more states become mixed.It is the inevitability of state mixing, of information diffusion, of information saturation -- the effect that I spoke of earlier, that information can always become more scrambled, but almost never, less -- that total entropy will rise, and it is in this direction that we experience "time" as we call it.Perhaps this even gives insight into how one might attack my proposed problem:Manipulate the statistics of Johnson-Nyquist noise in an otherwise ordinary resistor.For simplicity's sake, perhaps we shall use a somewhat contrived resistor, one which is metallic, ohmic, has a nice characteristic impedance (so the noise is flat with frequency), and consists of as few atoms as possible, being perhaps nanometers wide. We shall use a resistive element for the resistor itself, and superconducting wires to connect it to a very sensitive amplifier. It will be cool, but hardly near absolute zero. The dominant thermal modes will still be vibrational (phonon) and electric.We also put it in a vacuum, so we avoid phonon coupling from gas molecules. Being small, it also avoids basically any E&M radiation that would be a problem: as long as the whole resistor and superconducting wire leadouts are completed in some tens of nanometers, the structure should be literally "too small to see".Furthermore, we construct as much as possible from isotopically pure substances, using spin-zero isotopes (for example, a carbon film resistor, diamond substrate and insulation). This prevents nuclear moments from coupling as well.That's the setup. Now for the hard part. Suppose we construct a phased array of frequency/energy-agile photon amplifiers, attached to the base of this resistor fixture. Since the only energy in the system is coming from thermal phonons, and phonon-electron interactions, it should be -- in principle, if the world is as ideal as you suppose -- possible to manipulate, in some way, the fluctuations seen at the resistor terminal.Now, with "only" a few trillion atoms present, it should perhaps be possible to analyze the number of states, and by applying the correct sequence of phonon (vibrational) stimuli, manipulate the waves influencing the electrons, and perhaps manipulate the terminal voltage, ultimately.This does have to be subject to an additional constraint: because you essentially have control over most vibrations in the system, it istrivially easyto change its temperature, and thus vary the noise intensity. So I would further require that the average energy level from the phonon array be constant. With, say, a 1000^2 array of elements, this will retain more than enough degrees of freedom to be able to manipulate the signal in more precise ways (i.e., not just turning the noise on and off). In general, the data sent to the array will satisfy Maxwell-Boltzmann statistics, because it's the result of a deconvolution with some assumed model of the system's scattering behavior. Likewise, the signal output can't exhibit a different RMS value, but for example, its frequency spectrum could be modulated to convey a message. No one knows how to do this, right now. A Piezo array would be a good start, but ferroelectricity breaks down on small scales, so we can't make a nanometer scale phased array. Some research has been done with phonon lasers and stuff, which might eventually give rise to such a generalized instrument. For sake of argument, let's say we have one, though.I'm not sure just how many states are necessary to analyze such a system. Things go exponential (or factorial) really freaking quickly. A million-wide phonon array might not even be sufficient to control a trillions-of-atoms system. And the amount of memory and processing required to real-time solve the deconvolution is at least quadratic in that, so you're talking about basically doing DSP on the human genome in real time. And you only have a single output variable (voltage), so you have to watch it for an extremely long time to study what any given input sequence is doing to it, if anything.Clearly, doing this even for a very small, contrived system is difficult beyond belief; doing it foranymacroscopic system, ispatently impossiblein the realest possible meaning: that, even if each and every other atom in the Observable Universe could be turned towards computing the history of a single cubic centimeter of matter, there would be no time scale over which accurate enough observations could be made, nor the analysis performed, where that state transition could ever be computed!It is this, that it is the most technically impossible: in the thermodynamical, statistical, information-theoretic sense, that it is impossible to analyze bulk randomness. It is not simply chaotic, it is manifest, pervasive and fully saturating. To misunderstand this fact, is to delude oneself worse than thinking 1=2!Tim

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 28, 2016, 10:13:09 pm
content: Quote from: zapta on January 28, 2016, 04:08:06 pmTrue, and herein lies the problem.Computer algorithms like the ones in the Diehard suite which are used to check data for randomness may eliminate it because it does not 'appear' random.This means the algorithms may rule out even an ideal RNG. The video in the original post implies that the algorithms may have been selected to do exactly that.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 28, 2016, 10:49:09 pm
content: What's important is that the statistical tests fail at the predicted frequency.Tim

author: dannyf
author_rank: Super Contributor
timestamp: January 28, 2016, 11:03:07 pm
content: "This means the algorithms may rule out even an ideal RNG. "That's one of the things pointed out earlier in the thread. Tests like the diehard are statistical / probabilistic. That means they are subject to type 1 and type 2 errors.

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 28, 2016, 11:33:38 pm
content: Quote from: T3sl4co1l on January 28, 2016, 08:11:46 pmNews to me, Tim.I thought a reversible process is by definition time-symmetric. This means that if you filmed a process on camera and played it back to someone, they wouldn't be able to tell by looking if the film was running forward or backwards because both cases would make perfect sense.The Brownian motion is a good example of this. It makes perfect sense no matter which way you are playing the film.Radioactive decay and some other quantum phenomena on the other hand are definitely not time symmetric and you can always tell which way the film is running.For example if you see a film of X-ray particles impacting a photosensitive film you can definitely tell if the motion was running backwards. You do not expect blotches of developed film to condense back into an X-ray and fly away from the paper. The process is not time-symmetric and not reversible, even though it is (largely) predictable.QuoteThis boils down to the Markov Criteria from above. If you can't tell the next outcome by looking at the previous states it is 'good enough' for cryptographic purposes.If we could know the state of each atom and each electron in the resistor we could theoretically tell what the next outcome would be.The Heisenberg Uncertainty principle tells us that we can't actually look into a state of an electron without influencing it. So we are still cryptographically safe on that front.In the end I am not disputing the existence of true RNGs. I fully accept that a simple resistor produces thermal noise which is fully random, unpredictable, satisfies the Markov Criteria and everything.What I am after are the algorithms that test randomness in the RNGs. Apparently some of these are good and some of these are subtly tampered with in a way that they may fail a true RNG but pass a less than perfect RNG. My question from the beginning was about these algorithms.Can these algorithms be influencing the development of true RNGs to be predictable in some very subtle way.For example if you insist that the your RNG produces ones and zeroes in the exact 50% ratio even in short periods then you throw away the vast majority of your entropy.

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 28, 2016, 11:40:49 pm
content: Quote from: dannyf on January 28, 2016, 11:03:07 pmThis is exactly what I'm trying to get at. Thank you.But what do you mean by type 1 and type 2 errors?

author: CatalinaWOW
author_rank: Super Contributor
timestamp: January 28, 2016, 11:42:55 pm
content: False positives and false negatives

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 28, 2016, 11:48:29 pm
content: Quote from: CatalinaWOW on January 28, 2016, 11:42:55 pmThank you!So the simple test would be to take a true Random Number Generator, something based on radioactive decay or whatever and feed it to all those algorithms.If any of the algorithms gives type 1 or 2 error we throw it out and all is well.Seems easy enough.

author: dannyf
author_rank: Super Contributor
timestamp: January 28, 2016, 11:59:46 pm
content: It would really help you a lot if you read up more on statistics.

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 29, 2016, 12:24:15 am
content: Quote from: dannyf on January 28, 2016, 11:59:46 pmWill do. Thanks

author: MT
author_rank: Super Contributor
timestamp: January 29, 2016, 02:08:55 am
content: Quote from: Brumby on January 28, 2016, 01:57:57 amAbsolutely!http://www.dailymail.co.uk/femail/article-2025069/Joan-Ginther-Maths-professor-hits-multi-million-scratchcard-lottery-jackpot-4-times.htmlhttp://www.dailymail.co.uk/news/article-412386/University-lottery-syndicate-wins-5m-jackpot-devising-formula.html

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 29, 2016, 04:28:00 am
content: Quote from: HAL-42b on January 28, 2016, 11:33:38 pmYes -- elementary processes such as electron-electron "collision"; all the elementary forces where you'd draw a Feynman diagram (at least for QED and the like). Which are also space-time invariant, so for example, a particle going forwards is bounced backwards (i.e., turned into what we would call an antiparticle) on interacting with a pair of photons (pair production/annihilation), but it's the same as a scattering process (one particle interacting with a force particle).So it's not only conservative in time, but in space, and in both at the same time, which is a pleasing symmetry. At least for QED and the like.This type of interaction is what I mean by particles exchanging information. Apologies if that was not clear.QuoteAh, but these are all bulk phenomena*! So the entropy is exactly the kind of emergent property as I was talking about.The photon strikes the film grain, causing ultimately the entire grain to decompose and develop as a black speck. There's essentially no way to reverse such a chain of events, because so many particles have dissipated the information of that photon coming in.(Brownian motion being a property of fluids at constant entropy, we shouldn't expect to see a time direction.)*Arguably, radioactive decay is bulk in a sense (the nucleus contains a great many particles, at quite high energy: it is a system all its own!), but anyway, fusion is a known atomic process as well, so it would be foolish to say that a nucleus losing an alpha particle is only a time-forward phenomenon!Now, seeing a whole ensemble of, say, Pu-238 losing alpha particles, and only losing them as time goes on, would be quite suspicious; but as each particle is emitted, it bumps into other atoms, transferring various amounts of energy and momentum, and kicking phonons around in the lattice (literally, making it hot), so in this system as well, there is a massive preponderance of more interactions as time goes on, and entropy rising, and the dilution of information (the information about the decay of any one atom is all but imperceptible on the bulk level; almost all you know is it's hot and gives off helium!).QuoteThat's relevant to measuring atoms, but I was thinking (probably not too explicitly stated) about modifying the state, probably using an observation and deconvolutional method. Apply a random input, what does the output do? Repeat, well, about a trillion times, run an algorithm or whatever as needed, see if it improves, see if you can discover a controllable aspect of the output (again, besides bulk temperature).(A comparable process has already been achieved, on a much simpler scale: reconstructing visual or spacial (2D/3D) images from propagating or scattered light. Using a sufficiently accurate optical system and a similarly detailed scattering matrix and inversion, the light path can be reversed. A photon might scatter through millions of crystal domains in a translucent solid, so this achievement alone is not trivial. At least, that's what I recall they were claiming -- science reporting being what it is.)In any case, even for a relatively small (nano-scale) system, I've got to imagine the computational burden is already bordering on impossible, which even assuming the statistics could work out (which QM does indeed put rather tough limits on, for this sort of thing!), basically means you must invert cryptographic hashes in real time...Which is to say, at least at today's level,absolutely fucking yes,it's cryptographically secure.QuoteAs for algorithms, again -- you can always make low entropy into high, almost trivially; but reversing the process is nontrivial, bordering on impossible (indeed, physically impossible for macroscopic systems).If you had a sequence of numbers and no other information, how long would it take you to discover what system(s) underly that sequence? Even if you knew it was something (say, a Mersenne Twister sequence, which is used by MATLAB for example), how long would it take before you could confirm it?*(*In this case, at least the bit length of the state variable. Which is usually >256 bits for this example; I forget what exactly is typical.)And keep in mind that confirmation includes removing all the possible steps that have been applied to it after the number generation itself. For example, if the sequence follows a normal distribution, it might be reasonable to suppose someone called normrnd(mu, sigma) a bunch of times. But even just for that: for each time it was executed, which function call was made first? (Generating a normal random value requires two random inputs, essentially one for magnitude, one for phase.) Or was one single call made, and two halves used? Was it chopped up or scrambled or hashed first? Maybe your sequence of numbers has a flat distribution; if it happened to consist of a series of hashes (yet still ultimately arising from the same source in question), how would you know? How long would it take to prove it?So finally, the point is: there is no such thing as true random, in a physical sense, because it would take this trans-astronomical amount of computational power to determine the set of all possible algorithms that could generate the given sequence (even given constraints, like that they be relatively simple algorithms and thus likely to have been written by humans, and likely to cause trouble in still other relatively-simple algorithms). And that the set (even with those constraints) is probably too large to be of any value anyway.The only things that make cryptography vulnerable today are obvious bugs and backdoors (from social engineering to bad implementations), and the fact that, in the great scheme of things, we haven't even begun to scratch the surface of computational or convolutional complexity, so it's relatively easy to guess our relatively simple constants, or algorithms. The universe is a humbling place, I suppose...Tim

author: HAL-42b
author_rank: Frequent Contributor
timestamp: January 29, 2016, 05:05:50 am
content: QuoteIndeed, but that is for another thread.

author: VK3DRB
author_rank: Super Contributor
timestamp: January 29, 2016, 11:28:22 am
content: In the physical world, randomness has never been proven. Same with free will and predetermination. There is no evidence that something just happens without cause.

author: dannyf
author_rank: Super Contributor
timestamp: January 29, 2016, 11:53:11 am
content: Your statement would be perfect with a knowledge qualifier.

author: Brumby
author_rank: Unknown
timestamp: January 29, 2016, 12:12:41 pm
content: Quote from: MT on January 29, 2016, 02:08:55 amInteresting case. An advanced 'pattern matching' effort could explain it. We may never know.QuoteThese guys just had their turn. I had a guy working for me once who was addicted to gambling. It became a bit of a problem, impacting his work, so I took him aside. He was very keen to show me his 'system' - which turned out very much like these guys. It's statistical flim-flam which makes NO difference to the probabilities of winning.Just numbers out of a hat (or box).

author: helius
author_rank: Super Contributor
timestamp: January 29, 2016, 06:39:30 pm
content: The Gambler's Fallacy presents one possible way to distinguish true random sequences from pseudorandom ones. In a true random sequence, history has no influence on the output of the random oracle: if you just flipped a coin that landed heads 12 times, the chance that the next flip is heads remains 1/2. In a pseudorandom generator, the history of past outputs and the future outputs arealwaysrelated. The trick is to design a statistic that extracts that correlation from an apparently random sequence. For instance, you could look for regions where bias accumulates, and whether it is later removed. A truly random sequence spends vanishingly little time at zero bias point.

author: timb
author_rank: Super Contributor
timestamp: January 30, 2016, 01:10:45 am
content: Quote from: MT on January 29, 2016, 02:08:55 amThere was an episode of NUMB3R5 about this. A bunch of former lottery winners that had burned through their winnings started robbing gas stations and taking nothing but one particular type of scratch off ticket. They were scratching thousands of them to try and decode the serial number information. The idea being that, once they had that the could determine the serial of the "Big Winner" ticket. Then they used someone inside the lottery commission to provide the location of that ticket.All a bit far fetched, but the serial number part is actually plausible. If you had enough tickets and input the serial number and the winning status of them all, you could certainly figure out the how the serials were generated.It sounds like the lady in the first article was doing this. She was up to something, that's for sure. Or else she has two penises that have been been struck by lighting twelve times without a cloud in the sky.Personally, I don't see why the serials on scratchers aren't just randomly numbered. The lottery commission could then keep a database of which serial numbers correspond to which winners. That's how I had always assumed it was done, but apparently, at least according to an article I read, it's not. There's some sort of algorithm used to encode the unique ticket number plus status of each playable line, square or whatever (the part you scratch). That generates the serial number, which can be decoded on the fly with the right key.

author: zapta
author_rank: Super Contributor
timestamp: February 01, 2016, 12:48:24 am
content: Quote from: VK3DRB on January 29, 2016, 11:28:22 amProofs exist in philosophy, logic and math. Finite observations of the real world and generalizations base on them are useful but are not 'proofs'.

author: GK
author_rank: Super Contributor
timestamp: February 02, 2016, 01:03:14 pm
content: I'm pretty sure that objection comes from someones religious sensibilities being offended; you know, there is no evidence that something just happens without cause, thus God must be the ultimate cause. Though if nothing happens without cause then God must also have a cause, so if you maintain that nothing can happen without cause you're left with an infinite regression and invoking God as a convenient stop at any stage in that regression is clearly a violation of your own rules.Unless of course you just blithely object that nothing happens without cause except of course for God, who (hallelujah!) did just happen to have happened without cause (presumably having just randomly poofed into existence from nothingness), thus making God the First Cause; the standard proof for the veracity of this illogical exception of course being that it simply is the obvious and revealed truth! praise Jesus!I've yet to hear a good argument as to why this exception must be valid. I'm pretty sure it was Bertrand Russell who astutely pointed out that if everything must have a cause with the exception of one special thing, then that special thing might just as well be the Universe as much as God; at least we have reasonable evidence that the former exists.

author: Kjelt
author_rank: Super Contributor
timestamp: February 02, 2016, 03:01:40 pm
content: Quote from: T3sl4co1l on January 29, 2016, 04:28:00 amIn theory you are right, a true random number generators output might be described by some algorithm.In practice it is still very usable also for crypto: since you have no algorithm that predicts the next number, only the sequence of past numbers.The next number will still be truely random. When it is known some device might recalculate the algorithm that would have predicted that outcome which as you state would take a lot of time, so useless to break the system. If you do have an algorithm that would predict the coming numbers, that would make that rng useless for security.Another consideration, in most cryptographic applications the random number is transmitted in the clear to the other party, it's use is mostly to block replay attacks.

author: IconicPCB
author_rank: Super Contributor
timestamp: February 02, 2016, 09:53:14 pm
content: One would need to have the EPOCH in order to remove any ambiguity about the randomness of an algorithms output.Some polynomial solutions are optimal length solutions where the epoch contains all the elements of a given length ( number of bits).For more see linear feedback shift registers

author: dannyf
author_rank: Super Contributor
timestamp: February 02, 2016, 11:09:22 pm
content: There are two separate things in this discussion.1. Is this world fundamentally random? Ie, if we knew everything there is to know, could we have described the world in a fully deterministic way?I think existing body of science would suggest the answer is no. But then we know for sure that the existing body of science is wrong, in the sense that they will be superceded or corrected by better theories to be invented in the future.2. Even if you could describe the world deterministically, do you want to do that?I think the answer is no in most cases, as doing so would require so much information and processing that it is hardly worthwhile for most cases.In the end, randomness is an optimal way for us to ignore secondary factors and focus on the key issues that help us further our understanding of the world around us.It is the incorrectly correct way to approach complex systems. "Incorrectly" in the sense that it fails to factor in all that are impactdul. "correct" in the sense that it is a sensible approach that gets us 90 percent there on 10 percent efforts.

author: helius
author_rank: Super Contributor
timestamp: February 03, 2016, 11:17:15 am
content: With respect to 1., the laws of quantum mechanics are actually completely deterministic. The wavefunctions are related by operators that have an exact and unambiguous meaning. It's no accident that they were based on a theory of classical physics that had a high level of generality (Hamiltonian circuits). Indeed, the concept of quantum computing would be nonsensical if the operations were somehow unpredictable. What causes apparent random observations of quantum states is that the macroscopic system (us) has so much entropy that our exact interaction with the quantum system appears probabilistic. When we interact with objects at our own familiar scale (in classical mechanics), the behavior is deterministic again, but this is simply an outcome of the Law of Large Numbers: we really have no way to predict the behavior of the ensemble of interacting particles, but there are so many quadrillions of those interactions that we can predict their average.

author: dannyf
author_rank: Super Contributor
timestamp: February 03, 2016, 12:00:15 pm
content: QuoteI don't if that's the best argument for or against randomness. A random variable can have fully deterministic distribution function (the equivalent of the wave functions), but that "deterministicness" of the distribution function does not mean the random variable described by this deterministic distribution function is "deterministic".If anything, quantum theory would suggest strongly at the fundamental random nature of the world - how do you describe an object moving from one discrete position to another discrete position (as measured in multiples of planck constant)? particles' positions can only be described in terms of probability + dimension....I tend to agree with you that the seemingly deterministic way we use to describe the world is due to the law of large numbers -> fundamentally random acts produce apparently and statistically non-random behaviors.

author: GK
author_rank: Super Contributor
timestamp: February 03, 2016, 12:49:42 pm
content: I'm pretty sure that modern physics is pretty firm on the immutability of Heisenberg's uncertainty principle as much as it is on, say, the laws of thermodynamics, so unless you're an omniscient being capable of comprehending the universe either in part or in whole without physical observation, your predictive abilities aren't going to be wholly deprived of chance due to any fundamental determinism in the laws that govern the universe.

author: HAL-42b
author_rank: Frequent Contributor
timestamp: February 03, 2016, 03:23:57 pm
content: Quote from: GK on February 03, 2016, 12:49:42 pmI agree completely. The existence of entropy and non determinism is beyond doubt and I am only interested in it's practical applications in cryptography. I did not expect this most rudimentary fact to be disputed, especially on this forum.

author: dannyf
author_rank: Super Contributor
timestamp: February 03, 2016, 03:59:21 pm
content: QuoteThat statement is a logic fallacy: if "non-determinism is beyond doubt", is that statement itself beyond doubt? If yet, ....At most you can say that it is beyond doubt ***currently***, leaving the possibility that it may not be so beyond doubt after all.

author: HAL-42b
author_rank: Frequent Contributor
timestamp: February 03, 2016, 04:38:25 pm
content: Nice bait, unless you are serious of course, in which case I'm sorry for causing further confusion

author: MT
author_rank: Super Contributor
timestamp: February 03, 2016, 04:43:28 pm
content: Current law of physics only apply to "this" universe i'm told.So assume universe = god then god has his head up his own arse and we all are deep into his/her shit!His/her mouth is the "black hole/s" and the butt hole is the "creation" of the "big bang".Assume multiverses = infinite number of god who each one of them have his/her head up the other god's arse'es infinite number of times!Both of these two loops need something to make them loop, enter "random fluctuations", like flatulent gases caused by pea soup= dark energy!Whenever life gets you down, Mrs.BrownAnd things seem hard or toughAnd people are stupid, obnoxious or daftAnd you feel that you've had quite enoughJust remember that you're standing on a planet that's evolvingAnd revolving at nine hundred miles an hourThat's orbiting at nineteen miles a second, so it's reckonedA sun that is the source of all our powerThe sun and you and me and all the stars that we can seeAre moving at a million miles a dayIn an outer spiral arm, at forty thousand miles an hourOf the galaxy we call the 'milky way'Our galaxy itself contains a hundred billion starsIt's a hundred thousand light years side to sideIt bulges in the middle, sixteen thousand light years thickBut out by us, it's just three thousand light years wideWe're thirty thousand light years from galactic central pointWe go 'round every two hundred million yearsAnd our galaxy is only one of millions of billionsIn this amazing and expanding universeThe universe itself keeps on expanding and expandingIn all of the directions it can whizzAs fast as it can go, the speed of light, you knowTwelve million miles a minute and that's the fastest speed there isSo remember, when you're feeling very small and insecureHow amazingly unlikely is your birthAnd pray that there's intelligent life somewhere up in space'Cause there's bugger all down here on Earth

author: vlad777
author_rank: Frequent Contributor
timestamp: February 03, 2016, 07:47:59 pm
content: But you choose constraints to be "fair" .(you choose constraints that describe randomness)

author: T3sl4co1l
author_rank: Super Contributor
timestamp: February 03, 2016, 10:37:08 pm
content: Remember, QM works out perfectly well if you suppose that particles retain a given state since their creation or last interaction. That is, suppose when an entangled pair of photons are created, that their spins are known and fixed, we just can't inspect them, because they're so small, the only way we have to observe them is direct interaction. So observationally, QM wins, despite such an assumption. The system still obeys QM, because QM is a probabilistic description, and of course we can't make any different observations, even if these states were already present.Except for one thing, Bell's Theorem.The direct consequence of this is, if you perform correlation measurements of entangled pairs (specifically with spin), you would predict a linear angle dependency on that correlation (that is, that two detectors register each particle in the same state). But the QM prediction goes as cos(angle).Tim

author: HAL-42b
author_rank: Frequent Contributor
timestamp: February 27, 2016, 02:13:14 pm
content: After a long while I found the answer to my own question.Long story short, an algorithm that checks for randomness is only effective to compare pseudorandom number generators, not true random generators. If the algorithm can't tell the difference between PRNG and a true RNG then the PRNG can be considered cryptographically secure. (Many many qualifiers apply)The above statement is mostly based onYao's Test(Andrew Chi-Chih Yao - 1982)This in itself does not sound like much but if you have a lot of patience you can go trough the following courseThis is the most accessible course on cryptography I've seen to date. Can't thank Professor Dan Boneh and the Stanford University enough for making it public. (Yao's test is mentioned somewhere in unit 2 or 3.)

author: helius
author_rank: Super Contributor
timestamp: February 29, 2016, 09:02:24 pm
content: Quote from: HAL-42b on February 27, 2016, 02:13:14 pmPRNGs are only cryptographically secure by construction, not by statistical testing. The same qualities that make a PRNG appear to be truly random (like equal distribution) make them cryptographically weak.

author: Kjelt
author_rank: Super Contributor
timestamp: February 29, 2016, 10:25:10 pm
content: Indeed any algorithm can per definition never be cryptographically secure since it is fully deterministic. You can only build a crypto secure rng based on a true RNG which has real entropy. A crypto secure rng is truely unpredictable.What a die hard test really tests if it can find any predictability in the generated sequence. If it can not it passes this test which still does not guarantee it is crypto secure, it only proofs that who ever has come up with those tests does find the sequence unpredictable.Someone else who defines another different test might find a predictable sequence.

author: helius
author_rank: Super Contributor
timestamp: March 01, 2016, 12:25:41 am
content: The main problem is that there is an "ambiguous middle term" at play here, when we speak of a sequence's predictability. What the Diehard tests do is treat sequences as black boxes: given no information on where the sequence came from, can you predict an item (or just a bit of an item) in the sequence? This is a kind of metric of worth for statistical randomness, where the primary criteria is to minimize the bias of the random function (which would skew statistical results). In cryptography, the assumption is that your attacker knows the code you're using, so he is not viewing the random sequence as a black box at all. He is using a different concept of predictability based on reversing the random function. A PRNG can pass the first kind of test and fail the second, because they use the same word "predictable" in completely different ways.

author: Kjelt
author_rank: Super Contributor
timestamp: March 01, 2016, 06:10:10 am
content: You,re right there. In theory A Prng can only pass a good test if the sequence is smaller then the overflow of the prng algo. For lfsrs that is easy, for aes-128 in some mode of operation suitable as prng, the sequence becomes so large computers can not grasp it.

author: dannyf
author_rank: Super Contributor
timestamp: March 03, 2016, 12:36:38 am
content: QuoteI think it depends on your definition of "algorithm". A "programming algorithm" is certainly deterministic. But an "analog algorithm", a resistive divider for example as a scaler, is inherently fully random.And then you have things somewhere in between, depending on implementation. For example, a neural network can be random or deterministic, depending on how it is implemented. and I am sure we can come up with other examples as well.

author: Kjelt
author_rank: Super Contributor
timestamp: March 03, 2016, 06:24:02 am
content: Hi Danny first I thought it was my english but I guess it all comes down to definition and this is what I meant with "algorithm"https://en.m.wikipedia.org/wiki/AlgorithmQuote

author: coppice
author_rank: Super Contributor
timestamp: March 03, 2016, 06:36:28 am
content: Quote from: Kjelt on March 03, 2016, 06:24:02 amIf your step by step process includes reading a genuine analogue AWGN source, and mixing it into the final numbers, its a non-deterministic algorithm.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: March 03, 2016, 07:35:05 am
content: Quote from: dannyf on March 03, 2016, 12:36:38 amThe problem I see with that argument is that algorithms implemented in the analogue domain is designed to operate within a narrow set of parameters. For example, the resistive divider will produce a voltage X within an explicitly specified tolerance. While voltages could vary from device to device, you still have a statistical measure of the actual voltages produced, which implies some degree of predictability within the system.Also, what people seem to overlook here is that determinism as a desired property of many crypto-systems. Reproducibility from an known initial state is important, otherwise your crypto-system is effectively useless. In other words, you want to be going forwards deterministically, like with a hash function, or a PRNG. The idea here to make state reversal difficult, guessing the initial state difficult, or to make the next prediction from the current output difficult.

author: Kjelt
author_rank: Super Contributor
timestamp: March 03, 2016, 09:47:49 am
content: Quote from: coppice on March 03, 2016, 06:36:28 amI think this is about definition. The random source is the real entropy, that should be absolutely non-deterministic.Your algorithm is the mixing, which is fully deterministic.Don't confuse the output which can be cryptographically secure, with the processing which does not have to be cryptographically secure if the entropy is good enough and fast enough refreshed, so watch out to never ever come close to letting the PRNG algorithm loop, which is the biggest concern.On the other hand there is also a time definition, a PRNG algorithm like for instance defined in the NIST SP 800-90 spec using AES-128 can be cryptographically secure till a certain date, after which (or with the sooner invention of a quantum computer) it is no longer considered secure. This in it self is ofcourse also a fully deterministic algorithm, if you know the state (key) of this algo you can predict the next outputs. So in the end it is always a combination of very good entropy (most important) (pools) and good PRNG's to generate more output then the TRNG can generate.

author: coppice
author_rank: Super Contributor
timestamp: March 03, 2016, 10:22:31 am
content: Quote from: Kjelt on March 03, 2016, 09:47:49 amYou seem to have an arcane definition of algorithm. We get the word from the name of the same mathematician who gave us the word algebra, and his world was full of real numbers, not precisely reproducible and not subject to strict IEEE754 truncation rules.

author: dannyf
author_rank: Super Contributor
timestamp: March 03, 2016, 11:44:40 am
content: QuoteI think your use of the word "algorithm" is fairly standard. and I was just pointing out that there can exist alternate interpretations of that word as well. Actually, the very link you showed has numerous mentions of other implementations of algorithm, like through an analog computer, or through mechanical means.the very example of "algorithm" used in the wiki link can be implemented in analog means through summing amplifiers, comparators, and (analog) switches, for example.

author: Kjelt
author_rank: Super Contributor
timestamp: March 03, 2016, 01:34:34 pm
content: Quote from: coppice on March 03, 2016, 10:22:31 amSo lets change it to "deterministic system" is that more clear?Quote from: dannyf on March 03, 2016, 11:44:40 amStill fully deterministic not usable as source for a TRNG. Actually there is not much that really can be used for a TRNG. A lot of microcontroller companies that claim to have TRNG's don't have them. Passing the FIPS140 is proof it is not a TRNG, since numerous times generating a number and not having the same number means not that it is a cryptographically random generator, there should be duplicates some time to make it unpredictable.

author: dannyf
author_rank: Super Contributor
timestamp: March 03, 2016, 02:11:51 pm
content: QuoteTrue. But that's a different question from whether an algorithm is inherently deterministic.QuoteAny analog circuitry is inherently random - noises are highly desirable here.QuoteI think most of them claim to have a PRNG.QuoteTrue. Hypothesis testing can only prove a negative, and with type 1/2 errors.

author: helius
author_rank: Super Contributor
timestamp: March 03, 2016, 02:50:15 pm
content: Under what set of assumptions are the reals "not precisely reproducible"? This smells like a very strange statement to me. I suppose I should be asking what you mean by "precise", since I can think of two different meanings: unambiguous; or within specified tolerance. In both cases reals are no less precisely reproducible than integers. First, because the roots of a polynomial, or a continued fraction, are just as definite and unique as a decimal; and second, because reproducing a real in an analog medium according to a tolerance presents no difficulties that are not true for integers also.

author: Kjelt
author_rank: Super Contributor
timestamp: March 03, 2016, 02:50:42 pm
content: Quote from: dannyf on March 03, 2016, 02:11:51 pmThey are also easy to be influenced with outside equipment.I remember our discussion couple of years ago about the lsb of the STM8 ADC

author: coppice
author_rank: Super Contributor
timestamp: March 03, 2016, 03:41:58 pm
content: Quote from: helius on March 03, 2016, 02:50:15 pmHave you ever heard of noise? Only digital processing is fully reproducible, and that's because of its limited resolution.

author: dannyf
author_rank: Super Contributor
timestamp: March 03, 2016, 06:45:21 pm
content: Computers crash, digital circuitry has error rates, even if they are much lower than "error rates" in analog circuitry.So digital isn't fully reproduceable. They are just much more (but not completely) immune to noises.

author: dannyf
author_rank: Super Contributor
timestamp: March 03, 2016, 06:47:17 pm
content: QuoteI do remember that. Aside from potential auto-correlation, I think that's a fully random number generator,

author: dannyf
author_rank: Super Contributor
timestamp: March 03, 2016, 06:57:30 pm
content: This actually reminds me: phase noise of a RC oscillator is random. And an RC oscillator is generally considered a digital circuit. So yeah, being digital can be random too.