[Cryptography] Boing Boing pushing an RSA Conference boycott

[Bear]

On Fri, 2014-01-17 at 14:03 -0800, Tom Mitchell wrote:
> 
> 
> On Thursday, January 16, 2014, Bear <bear at sonic.net> wrote:
>
>         PRNG's have nothing to do with one-time pads.  Compromised
>         PRNG's
>         affect stream ciphers, but one time pads do not use PRNG's.
>         
>         Bear
> 
> 
> But it is possible to use any bit/ number generator to fill in a one
> time pad (OTP).
> 
> 
>  I can imagine someone sharing a PRNG and seed so the far side of a
> conversation could generate their copy of a digital OTP pad.
> Subsiquent communication would "look" like a OTP conversation.  


That is exactly the definition of a stream cipher.  Use a deterministic 
(Pseudo-random) number generator and seed to produce a stream of bits 
to encrypt with, and you have a stream cipher, which is NOT a one-time 
pad.  

A one-time pad uses a fairly reliably *random* number generator, like 
this:  

http://gamesbyemail.com/News/DiceOMatic

Unfortunately "real" random generators are difficult to implement in 
software, but thermal noise sensors, lava-lamp and aquarium cams, and
microphones pointed at freeways give pretty good results.  And yes, 
so do more amusing implementations like DiceOMatic. 

Actually I think that the *noise* produced by DiceOMatic, sampled 
a second at a time and sent through a hash function, would be a much 
higher-bandwidth source of randomness than the dice reading that the 
machine is actually built to do. 

Hmm.  It should not be too difficult to equip many servers in the same
room with $10 USB cameras, and have them all pointed at a cheap,
known-chaotic physical system like an aquarium with a bubbling filter,
moving aquarium toys, and swimming fish -- all from different angles -- 
running the resulting video, a half-second at a time, through a hash
function, and using the results for "real" random numbers.  And it 
amuses me that the sysadmin's job could legitimately include feeding
the fish.

Bear