Category Archives: random

Does the permutation cycle of a PRNG change completely with different seeds?

Posted on by

Apologies if this seems like a trivial question.
I’ve been learning PRNG and cryptographic basics and I don’t think I’ve found an answer to this question (At least that I understand).
My understanding is that a PRNG has an internal state w… Continue reading Does the permutation cycle of a PRNG change completely with different seeds?→

Is it ok to use NativePRNGNonBlocking SecureRandom for making jwt? [duplicate]

Posted on by

I’m developing jwt auth feature with Spring WebFlux. And, I found the blocking calls in jjwt library by using BlockHound.
The reason of blocking calls was SecureRandom use /dev/random to make random number in default on Linux system.
To pr… Continue reading Is it ok to use NativePRNGNonBlocking SecureRandom for making jwt? [duplicate]→

Security of a non-random password but that relies on information an attacker cannot possibly know

Posted on by

I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure.

To give an example, let’s say that I generate my password by putting together the surnames of the first 5 people that I ever fancied. Let’s also assume that there is nobody in the world who knows those names apart from me. I can think of reasons for why this password can be considered both insecure and secure, and I am unable to determine which one is correct.

Reasons it might be insecure:

  1. The password entropy associated with this method for generating the password is 0. It is completely deterministic.
  2. All discussions I found on password security center around entropy, so this should be considered a weak password based on its entropy of 0.

Reasons it might be secure:

  1. The information required for generating a password using this method cannot be known by a potential attacker.
  2. The best an attacker can do is somehow figure out my method. Even then, the “word list” of all possible surnames would contain thousands of words, so perhaps the entropy should not be considered as 0 in practice?
  3. While it sounds like security by obscurity, I believe that it might not be, because this is a case where an attacker cannot possibly get to know the surnames.
  4. And all of this is assuming that the attacker can somehow figure out my method of generating the password, which they have no way of figuring it.

I went through lots of great questions on here regarding password entropy:

  1. XKCD #936: Short complex password, or long dictionary passphrase?
  2. Is “the oft-cited XKCD scheme […] no longer good advice”?
  3. Why are passwords generated by a password generator a complicated mix of letters and numbers instead of a long phrase?
  4. Should passwords be truly random?
  5. What does “random” mean in the context of password creation?
  6. Confused about (password) entropy
  7. Why use entropy at all in considering password strength?
  8. How secure is Snowden’s MargaretThatcheris110%SEXY password?

However, I am still unable to find the answer.

Continue reading Security of a non-random password but that relies on information an attacker cannot possibly know→

How did a cheap amazon RF key managed to clone master key with rolling codes? [migrated]

Posted on by

I have a garage and I have the master key which is 433MHz and the specifications say it is a rolling code. Here is a table of the specifications:

Range in open field (m): 100
Frequency: 433.92 MHz
Coding type: Rolling code
Number of butto… Continue reading How did a cheap amazon RF key managed to clone master key with rolling codes? [migrated]→