Cryptography-Digest Digest #339, Volume #9 Sun, 4 Apr 99 18:13:03 EDT
Contents:
Re: True Randomness & The Law Of Large Numbers (Herman Rubin)
Re: is it true that Irish teen found crypto alg faster that RSA
([EMAIL PROTECTED])
Re: Diffie Hellman - avoiding the man in the middle (Peter Gunn)
Re: True Randomness & The Law Of Large Numbers (R. Knauer)
Re: DES-source ("Ryan Phillips")
Re: True Randomness & The Law Of Large Numbers ("Trevor Jackson, III")
Re: True Randomness & The Law Of Large Numbers ("Trevor Jackson, III")
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (Herman Rubin)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: 4 Apr 1999 14:02:31 -0500
In article <[EMAIL PROTECTED]>,
Douglas A. Gwyn <[EMAIL PROTECTED]> wrote:
>"R. Knauer" wrote:
>> From my recollection of some 30 years ago, I recall that data
>> distributions must be square-integrable for the CLT to be valid.
>That's the same requirement as for them to have Fourier transforms.
>It's the same as requiring the system to have finite total energy.
>This is of course not very restrictive in practice.
Fourier transforms of distributions ALWAYS exist; it is not QUITE
necessary to have second moments for the CLT to be valid. However,
even if the CLT is valid, the approach is not that fast. For the
sum of n independent, identically distributed random variables with
THIRD moments, the rate of convergence in O(1/sqrt(n)).
>> Nevertheless, Triola does not restrict the CLT to just normal or
>> binomial sample spaces.
>That's because the CLT isn't restricted to those. It holds very
>generally, which is the beauty of the theorem. This is somewhat
>similar to Markov's inequality: P{X >= a} <= E(X)/a for any r.v.
>X >= 0, or Chebyshev's inequality: P{|X - E(X)| > k} <= Var(X)/k^2
>for any r.v. with finite E(X) and Var(X). (E(X) is the mean and
>Var(X) is the variance). These bounds aren't nearly as tight as
>we can come up with if we do know more about the distribution,
>but they are universal. I'm sure that Triola made this point in
>his discussion of the Chebyshev inequality.
However, the abuse of the normal distribution is so great that
it should be questioned whether it belongs in a first course as
something to be relied on. Often, it is not of much importance,
and few introductory books even point out where it is and where
it is not.
>> Statistics also requires that you know the actual distribution of the
>> data so you can calculate the significance of sample means in terms of
>> supporting or rejecting the null hypothesis.
>No, in fact if you knew the actual distribution of the data (how?
>only by observing the *entire* population), there would be no
>need to resort to statistics. It is a *model* of the population
>that is tested via statistical computation on the sample.
In most problems, one is not sampling from a finite population.
For testing purposes, one only needs the distribution of the test
statistics for the test to be exact. In practice, this does not
happen. Also, statistical significance is a total MISTAKE. If
the definition is carefully given, that definition is correct, but
this does not make it a reasonable basis for action, especially as
the "null hypothesis" being tested is false. The question is not
whether the null hypothesis is true, but whether it is close enough
that it is better to accept the simpler model. This is a HARD
question, and not much has been done about it.
>> IOW, you must know with certainty the mean and variance of the actual
>> distribution for the data in order to calculate the significance of
>> samples taken to support or reject the null hypothesis. The Z-score
>> requires certain knowledge of both mu and sigma for the data
>> distribution. Furthermore, according to Triola, the mean and standard
>> deviation of the data distribution must be known for an infinitely
>> large population.
.................
>> Can anyone give the distribution for a true randomness process?
>Sure; in fact if you have no clue what it is you cannot build
>your TRNG correctly.
>> What are its mean and standard deviation in the infinite limit?
>What infinite limit? They're just parameters used in the process,
>or computable from such parameters. First, you need to say which
>process you have in mind. If it is supposed to output uniformly
>random bits, and the r.v. X is the value of a generated bit, then
>X has mean 0.5 and s.d. 0.5.
>> And does the CLT apply for that distribution?
>Of course it does.
>> If you cannot give the actual distribution for a true random process,
>> or if you cannot model it with a pseudo-random process, then you
>> cannot claim that statistical tests have any validity in the
>> determination that a process is not truly random.
>Too bad for you that I did just give the parameters of the
>distribution (actually, just the first two moments,
>but the others are readily calculable) for your "true
>random process".
This is quite correct.
But now we have the real problem; is the actual process
close enough to the non-existent TRNG that, for the current
purpose, one should go ahead and use it. It is not a
question of "statistical significance"; it may be that one
should use something for which a typical significance test
would reject by using fixed significance levels, and it may
be that one should not use something which is accepted by
the usual significance level. It is the balancing of the
risks which is needed.
--
This address is for information only. I do not claim that these views
are those of the Statistics Department or of Purdue University.
Herman Rubin, Dept. of Statistics, Purdue Univ., West Lafayette IN47907-1399
[EMAIL PROTECTED] Phone: (765)494-6054 FAX: (765)494-0558
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: is it true that Irish teen found crypto alg faster that RSA
Date: Sun, 04 Apr 1999 20:32:18 GMT
> For what it's worth, I recognized two red books on her bookshelf during the
> interview: Schneier's "Applied Cryptography" and Stinson's "Cryptography,
Theory and
> Practice".
>
Has she ever posted in here? Does she have a website?
Faster then rsa? Isn't ECC faster?
Tom
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
From: Peter Gunn <[EMAIL PROTECTED]>
Subject: Re: Diffie Hellman - avoiding the man in the middle
Date: Sun, 04 Apr 1999 20:48:42 +0100
DJohn37050 wrote:
> See IEEE P1363 for a discussion of all/most of these things. There are many
> details you are missing that could make things insecure.
> Don Johnson
Ok, thanks, Ive got it now. :-)
I like the bit that shows estimates for MIP years for key and
prime sizes in the section on "Security Considerations".
So, here are my conclusions so far...
* A base of 2 is ok
* 128bit hash (generator order) ~= 512bit prime (modulus)
which requires ~4x10^5 MIPs years to break... which doesnt
sound very secure to me :-)
* 172bit ~= 1024bit => ~3x10^12 MIPs years to break... which
sounds like what Im after.
* only way to avoid the 'man in the middle' is to check a
'certificate' he supplies with some trusted third party.
I'll just ignore this for now :-)
Im still digging to try and find if its ok for the prime p to
be public knowledge, but Im assuming for now that it is.
There is no mention of 'strong' or 'weak' primes? So, I guess
this isnt important? For now, I'll probably just nick a
1024bit one from someone else, and generate my own later on.
In a quick check it takes ~150ms to work out z2=(y1^x2)%p
on my PII 233, when p is 1024bits long... which should be OK :-)
I need to get a 172bit hash function, as the RIPEMD-160 I'm
using doesnt cut it... hmmm... maybe Tiger?? Or maybe GOSTHASH?
that was a bit slow, and my attempt to write my own version
simply failed, but it was 256bit :-)
If you can spot any obvious omissions, errors, etc., feel
free to point them out.
ttfn
PG.
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: Sun, 04 Apr 1999 19:31:35 GMT
Reply-To: [EMAIL PROTECTED]
On Sun, 04 Apr 1999 04:09:47 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
wrote:
>> From my recollection of some 30 years ago, I recall that data
>> distributions must be square-integrable for the CLT to be valid.
>That's the same requirement as for them to have Fourier transforms.
>It's the same as requiring the system to have finite total energy.
>This is of course not very restrictive in practice.
Then you agree that distributions that are not square integrable
invalidate the CLT. Good, that is a most fundamental criterion.
>> Nevertheless, Triola does not restrict the CLT to just normal or
>> binomial sample spaces.
>That's because the CLT isn't restricted to those. It holds very
>generally, which is the beauty of the theorem.
Yes, it holds for *most* distributions. But it does not hold for
distributions that are not square integrable.
This is somewhat
>similar to Markov's inequality: P{X >= a} <= E(X)/a for any r.v.
>X >= 0, or Chebyshev's inequality: P{|X - E(X)| > k} <= Var(X)/k^2
>for any r.v. with finite E(X) and Var(X). (E(X) is the mean and
>Var(X) is the variance). These bounds aren't nearly as tight as
>we can come up with if we do know more about the distribution,
>but they are universal.
>I'm sure that Triola made this point in
>his discussion of the Chebyshev inequality.
Triola only mentions the vague notion of a "bell shaped curve". And he
only states Chebyshev's theorem - he does not derive it - in a problem
at that.
>No, in fact if you knew the actual distribution of the data (how?
>only by observing the *entire* population), there would be no
>need to resort to statistics. It is a *model* of the population
>that is tested via statistical computation on the sample.
That will only work if the CLT is applicable. If the CLT is not
applicable for a given model distribution, then there is no
statistical inference possible.
All the statistical tests in Trioli, both parametric and
non-parametric, require the CLT to be of any use.
>Having helped a student through Triola last summer, I know he
>didn't say things the way that you're trying to reinterpret
>them. There is a distinction between the "true" mean and
>variance of a population (which is in principle unknowable if
>the population is infinite, and unknowable in practice if the
>population is too large to permit exhaustive sampling) vs. our
>best estimates of the population mean and variance computed
>from the actual sample. Triola shows how the latter can be
>correctly used in reliable statistical testing; one does *not*
>have to know the unknowable. The ideal is used as the basis
>for developing an exact, simple theory to understand the
>concepts, whereas the actual is used as the basis for *doing*
>the tests. This doesn't invalidate the tests, because they
>take into account the necessary adjustments.
You did not listen to what I said. Unless you know the distribution is
of the proper type, you cannot a priori apply the CLT, which is
necessary for statistical testing to have any validity. The whole body
of statistics is the explication of the consequences of the CLT.
Without the CLT, there would be no standard statistics such as is
described in Triola.
>The more one *knows* (or can safely assume) about the parent
>distribution, the sharper (more powerful) the tests can be.
>Since many cases in practice are approximately Gaussian,
I have no problem with that statement.
>and since the CLT says that Gaussian is appropriate in many other
>situations,
I have a real problem with that statement. The CLT cannot be used to
validate the earlier statement. You are talking in circles.
First you say (correctly) that many useful applications have gaussain
distributions which allows the use of the CLT (although a distribution
does not have to be binomial for the CLT to be valid), and then you
turn around and claim that the wide applicability of the CLT is
justification that many distributions are gaussian.
You might want to tutor someone in Logic 101 next summer.
>most elementary statistics courses emphasize
>tests against the normal distribution. But there are other
>tests that are "model-free", i.e. don't need to make such
>assumptions. One could cobble one up directly from the
>Chebyshev inequality, for example (actually we can do better),
>and it would be a universal (model-free) test.
There are four distinct classes of distributions. Triola discusses
only three of them - he does not discuss the class of distributions
which are non-square integrable. The other three classes can be
grouped into parametric and non-parametric. In fact, non-parametric
distributions are one of the four classes. The two kinds of
distribution left are the normal distribution, which is automatically
parametric, and the non-normal paramteric distribution.
>> Can anyone give the distribution for a true randomness process?
>Sure; in fact if you have no clue what it is you cannot build
>your TRNG correctly.
Well, OK then, Mr. Know-It-All. Exactly what is the distribution for a
TRNG?
>> What are its mean and standard deviation in the infinite limit?
>What infinite limit? They're just parameters used in the process,
>or computable from such parameters.
Wrong! The distribution must be square integrable for the CLT to apply
and that means it must behave in a certain way at infinity. Just look
what si implied by your beloved Chebyshev theorem.
>First, you need to say which process you have in mind.
A quantum random process has been chosen a long time ago.
>If it is supposed to output uniformly
>random bits, and the r.v. X is the value of a generated bit, then
>X has mean 0.5 and s.d. 0.5.
Prove that. But be careful about your assumptions, because if you go
off into classical statistical theory you will miss the mark.
Once again, I will state the specification for a TRNG:
+++++
A TRNG is a process that is capable of generating all possible finite
numbers equiprobably, namely in an independent and equidistributed
manner.
+++++
There is no assumption of any model process contained in there. There
is no hint anywhere that the process must be a uniform Bernoulli
process or a Markov process or any process. I have added the
additional conjecture that a quantum random process satisfies the
specification above because I believe that quantum computers can be
constructed which meet that specification.
>> And does the CLT apply for that distribution?
>Of course it does.
Nope. There is absolutely no a prioi reason to assume that a TRNG
process meets the criteria for validity of the CLT.
We are finally getting down the most basic considerations, testing
assumptions each step.
>> If you cannot give the actual distribution for a true random process,
>> or if you cannot model it with a pseudo-random process, then you
>> cannot claim that statistical tests have any validity in the
>> determination that a process is not truly random.
>Too bad for you that I did just give the parameters of the
>distribution (actually, just the first two moments,
>but the others are readily calculable) for your "true
>random process".
You gave the model parameters for a *pseudo-random* process, not a
true random process. There is no a priori reason to believe that
quantum random processes are pseudo-random in any way.
Bob Knauer
"The brave men who died in Vietnam, more than 100% of which were
black, were the ultimate sacrifice."
- Marion Barry, Mayor of Washington, DC
------------------------------
From: "Ryan Phillips" <[EMAIL PROTECTED]>
Subject: Re: DES-source
Date: Sun, 4 Apr 1999 13:14:56 -0700
Oops, ftp://ftp.replay.com/pub/replay/crypto/LIBS/des/
Ryan Phillips <[EMAIL PROTECTED]> wrote in message
news:7e8g7a$jde$[EMAIL PROTECTED]...
> check ftp://ftp.replay.com/pub/replay/libs
> they have a whole section on DES
> Pontus <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED]...
> > Anyone here that can point me to some source to some DES-enrytption...
>
>
------------------------------
Date: Sun, 04 Apr 1999 17:32:38 -0400
From: "Trevor Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: True Randomness & The Law Of Large Numbers
Sadly, most of this is not relevant. Consider that an independent,
equiprobable, single-bit generator is all we need, why worry about
multi-bit sequences? IFF you have a generator that produces
independent, equiprobable bits, you have everything you need.
The whole point of testing the output of an RNG is to evaluate whether
indeed the RNG does produce individual bits correctly. Many tests are
related to the machine architecture we use, because machine architecture
can influence, contaminate, the output. Other tests evaluate spectral
characteristics of the bit stream. The hyperplane tests inspect for
medium-range correlations among the bits.
Even a quantum source has to be evaluated, TESTED, to see if it really
produces what it is supposed to produce. All of these tests and more
are necessary even for an RNG that has been vetted by analytic
inspection.
R. Knauer wrote:
>
> On 4 Apr 1999 09:13:35 GMT, [EMAIL PROTECTED] (Bryan G. Olson; CMSC (G))
> wrote:
>
> >I haven't written anything that implies no statistician will write
> >about abnormal phenomena or fluctuations. You simply have not
> >understood what theory applies where.
>
> I am not alone. Everyone here has assumed that the pseudo-random model
> applies to true random number generation. I claim that such an
> assumption is unfounded, and is actually incorrect. I cannot prove
> that, since I am not an Expert. I am an Informed Layman (tm) and the
> best I can do is play Devil's Advocate. And one of the priviliged
> advantages I have is that because I am not an Expert, I can readily
> admit when the position I have taken is wrong. I have no professional
> ego to defend.
>
> I claim that true randomness cannot be modeled by classical analytical
> processes like those discussed in standard statistics. One must go to
> processes that are quantum mechanical in nature, and that means a
> completely different kind of statistics, namely quantum statistics,
> which has very little to do with standard statistics.
>
> >And to show that your predictions about a random walk are wrong,
> >we certainly don't need to.
>
> I did not introduce the random walk to make predictions, only to point
> out that even pseudo-random notions can be counter-intuitive.
>
> I tried to create an analogy with random number generation when I
> discussed the characteristics of the gaussian, something which you and
> others showed me is not appropriate. One cannot fabricate a correct
> analogy with the gaussian to point out that true random number
> generation is not pseudo-random. It will take other considerations
> than that.
>
> Therefore I am now going to drop any further considerations of the
> random walk because it is getting us nohwere. Anyway, I had to return
> Feller's book to the library, so I can't refer to it anymore.
>
> >: IOW, I am challenging your contention that true randomness can even be
> >: modeled mathematically, even to the extent that you can determine with
> >: reasonable certainty tbat a process is not truly random based on
> >: statistical tests.
>
> >But your doing it by not defining your terms.
>
> I believe I have.
>
> True randomness is a process which is capable of generating all
> possible finite sequences equiprobably, namely in an independent and
> equidistributed manner.
>
> What terms do you think I have not defined in that specification
> above?
>
> >O.K.; I'll bite. First I challenge you to define what you mean.
>
> I just did above when I gave the specification for a TRNG.
>
> >I'll assert that statistical hypothesis testing can show that some
> >bad candidate TRNGs are in fact bad.
>
> You can only do that if the Central Limit Theorem (CLT) applies. All
> of classical statistics, even non-parametric statistical tests,
> require that the CLT applies. If, however, a distribution is not
> square integrable all the way to infinity, for example, then the CLT
> is not applicable and all your beloved statistical tests, parametric
> and non-parametric alike, go straight to hell in a handbasket.
>
> >Now precisely how can you use
> >this to deterministically generate true random numbers?
>
> I would use it to cull sequences that did not pass your statistical
> tests. A given set of sequences is either random or not based on your
> tests. There cannot be a third category of "maybe random, maybe not
> random. If that were the case, then your tests for non-randomness
> would not be reasonably certain. So if a given set of sequences is not
> rejected, it must therefore be random based on your tests.
>
> If your tests cannot tell me that a set of sequences is non-random
> with reasonable certainty, then they are useless (except maybe as
> diagnostic aids).
>
> >WhileI've merely read about the fundamentals of probability and
> >statistics. I've found that understanding a little is better than
> >cataloging a lot. I've often joked that I have a friend who's into
> >Chaos Theory, only he thinks the point is that we must find and kill
> >some butterfly.
>
> Do you fully understand all the assumptions upon which the CLT is
> based? Do you fully understand that all of standard statistics is
> based on the CLT? Do you fully understand that if a distribution does
> not meet the conditions for the validity of the CLT, then standard
> statistical tests do not apply?
>
> >Given any reasonable estimate on the probability that the TRNG
> >is broken in such a way as to produce 80 zeros in a row, I
> >quantify a lower bound on the probability that the candidate
> >TRNG is broken, and that probability will be close enough to one
> >that I can safely reject it.
>
> You are using pseudo-randomness as the criterion for rejecting the
> TRNG. Can you give fundamental reasons why you believe that
> pseudo-randomness is a correct model for true randomness, if even only
> as a necessary condition?
>
> >Again, I must point out the importance of quantitative reasoning.
> >How long you've known what and the loneliness out there will not
> >help us answer the question. One hundred standard deviations
> >will.
>
> Only if the distribution is the kind for which the CLT is applicable.
> If the distribution is not square integrable, then the CLT does not
> apply, and your beloved 100 standard deviations have no meaning.
>
> For example, what if the distribution is flat? That is not a square
> integrable distribution when extended to infinity, and therefore the
> CLT does not apply. That means that all your statistical tests are
> invalid, across the board - because they are all crucially dependent
> on the CLT.
>
> Could the distribution for the TRNG process be such a flat
> distribution, a constant value in the entire sample space? Consider
> this model for a TRNG:
>
> I prepare one sample space for each kind of n-bit sequences by putting
> each of the possible sequences in a jar. There are 2^n such balls of
> each kind (with n-bits), and the full ensemble is obtained if there is
> exactly one of each ball of each kind of possible sequence. So far I
> have meet one of the specifications for a TRNG, namely that the
> ensemble is made up of all possible finite sequences. If there is one
> and only one instance of each possible sequence in the jar, then they
> are also equidistributed. All that is left is to meet the condition of
> independent selection.
>
> I shake the jar up to randomize it. Now I am reasonably certain that
> if I reach in and grab one sequence, that the selection process is
> independent.
>
> What is the distribution for such a process? Well, the first thing to
> note (which I think is of critical importance) is that the sequences
> are all distinguishable. No two sequences are the same in terms of the
> use as keys in the OTP system. Therefore there is no binomial
> distribution.
>
> The binomial distribution is produced when sequences are considered to
> be combinations of bits, not permutations of bits. For example, for
> 3-bit sequences we have 8 possible sequences:
>
> 000, 001, 010, 011, 100, 101, 110, 111
>
> Considered as combinations, there is one with no 1s (000) , one with
> no zeros (111), three with one 1 (001, 101, 100), and three with one 0
> (011, 101, 110). Treating the three sequences with one 1 all the same
> gives rise to the binomial distribution.
>
> If the sequences are not treated in groups of the same kind, then the
> distribution is not binomial, but is a flat distribution. But that is
> precisely the specification of a keystream generator, because each
> sequence is unique for purposes of crypto.
>
> If the key is 101, that is not the same as 110 or 011. Those are three
> separate keys, each leading to different ciphertexts. It is a
> fundamental error to treat bit-grouped sequences the same just because
> they have some property that makes them *appear* to be the same.
>
> In fact, that is what is meant by pseudo-randomness, namely that
> bit-groups of sequences appear to be the same by virtue of having the
> same number of 1 bits. Treating sequences on the basis of the same
> count groups of 1 bits is to group them into a binomial distribution.
>
> But clearly that is not the proper way to look at sequences for
> crypto, because bit-grouped keys with the same number of 1 bits are
> not all the same in terms of the ciphers they produce. If 001, 010 and
> 100 were all the same key for purposes of encryption, then the
> resulting three ciphers would all decrypt to the same plaintext. But
> we know that is not the case for the OTP system.
>
> Therefore pseudo-randomness, which comes from bit-groups and the
> resulting binomial distribution, is fundamentally incorrect for
> modeling true randomness because sequences are fundamentally unique
> and cannot be bit-grouped under a binomial distribution. Therefore
> pseudo-randomness is not applicable, not even as a necessary condition
> for true randomness.
>
> Now the question comes down to whether the distribution of unique
> sequences is square integrable. If it is not, then the CLT does not
> apply, and your beloved statistical tests are all invalid across the
> board - even as necessary conditions.
>
> Square integrability must be carried out to infinity. But that does
> not seem to be a problem at first glance, since if the ensemble is
> finite there is a cutoff where the distribution drops to zero for all
> values greater than the cutoff. It would seem that this constant, flat
> distribution is indeed square integrable because of that cutoff.
>
> This is where my lack of formal training in number theory causes me to
> have to stop. But I am deeply suspicious that the integral is not
> defined even for a finite interval, because the TRNG must be capable
> of generating ALL possible finite sequences, and this number grows in
> an unbounded manner. Because the distribution is flat, it never tails
> off and the integral becomes unbounded as the number of sequences gets
> larger and larger. In that sense, the distribution is not square
> integrable, the CLT does not apply, and standard statistics has no
> meaning in terms of tests for significance.
>
> I have given you math experts something to contemplate - so have at
> it. But I trust you at least see the significance of the fact that in
> crypto, each sequence is unique and cannot be combined into bit-groups
> which are distributed binomially.
>
> If I have made that point successfully, then I am satisfied for
> today.
>
> Bob Knauer
>
> "The brave men who died in Vietnam, more than 100% of which were
> black, were the ultimate sacrifice."
> - Marion Barry, Mayor of Washington, DC
------------------------------
Date: Sun, 04 Apr 1999 17:35:14 -0400
From: "Trevor Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: True Randomness & The Law Of Large Numbers
R. Knauer wrote:
>
> On 4 Apr 1999 09:17:53 GMT, [EMAIL PROTECTED] (Bryan G. Olson; CMSC (G))
> wrote:
>
> >Can you quote where FIPS-140 says that? Note that saying to
> >reject a generator that fails statistical tests is not the
> >same thing.
>
> I claim that there are only two valid sets for randomness:
>
> Set #1: Reasonable certainty that the process is not random;
>
> Set #2: Processed which do not exist in set #1.
>
> Put into the language of statistics:
>
> Null Hypothesis: A particular RNG is not random.
>
> Alternate Hypothesis: That particular RNG is random.
>
> There is no middle set of RNGs that are maybe random, maybe not random
> on the basis of reasonable certainty. There is a definite area outside
> the Z-score and a definite related area inside the Z-score. There is
> no gray zone where things may be or may not be simultanously.
Garbage. No one here has said that there exists a perfect or
comprehensive set of statistical tests. In fact I among other have
argued that there *cannot* be such a set of tests. Thus your "Alternate
Hypothesis" is flawed. C.F., the problem of "the excluded middle".
>
> Therefore, it a RNG fails those statistical tests, it is reasonably
> certain that it is not random, and if it does not fail those tests, it
> is reasonably certain that it is random. If you claim that there is a
> third set of maybe/maybe-not, then there can be no set of TRNGs that
> are reasonably certain to be non-random.
>
> You can't have it both ways. Either a TRNG can be determined to be
> non-random, in which case there is no set of maybe/maybe-not random
> TRNGs, or the opposite is the case and then your tests are worthless.
>
> Bob Knauer
>
> "The brave men who died in Vietnam, more than 100% of which were
> black, were the ultimate sacrifice."
> - Marion Barry, Mayor of Washington, DC
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
