[14083] in cryptography@c2.net mail archive
Re: cryptographic ergodic sequence generators?
daemon@ATHENA.MIT.EDU (Anton Stiglic)
Mon Sep 8 13:22:41 2003
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
From: "Anton Stiglic" <astiglic@okiok.com>
To: <cryptography@metzdowd.com>
Date: Mon, 8 Sep 2003 10:17:15 -0400
> [...]
> The Yarrow RNG uses counter-mode as a PRNG. However in the paper they
> describe some effects you may want to avoid by re-keying depending on
> your application as the stream becomes distinguishable from random
> output.
>
> Adam
This is essentially because if your output sequence of n-bit blocks were
really random,
you would expect to see a collision between two n-bit blocks after seeing
about 2^(n/2)
block outputs (birthday paradox), but using a block cipher with a counter
gives you no
collision before 2^n block outputs. This is indeed why in the Yarrow design
they
suggest to re-key after 2^(n/3) block outputs.
--Anton
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
