waxwing on nostr

Open in Damus

@waxwing 1785683430

Fwiw i thought more about it last night, chatted with Claude about it, and saw a serendipitous tweet from Matthew Green making similar points in the negative:

I don't think what I'm alluding to here is even really possible at all; you can't really 'verify that you're actually getting random output', and not only because of intermediate hashing steps.

Wish I were wrong but it really seems that way.

There are other interesting ideas around testing, but I want a 'one click' version for a user, and I can't find one unless they generate the entropy themselves and do not mix it with from-device entropy. So dice rolls and similar.

waxwing @waxwing · 4d

We all (who have tech skills) are at least a little bit at fault. We never developed some kind of norm of: how can you assure your users that their private keys are 'proper'? Were they supposed to look at them? No. If you grab your randomness from the OS, you can't know, via t Show more

17❤️2👌1

Tyler Burns · 4d

Ya, I was thinking a lot about it last night as well. I agree that as an end user it is impossible to validate randomness. The only thing you can do as an end user is minimize the risk of it. Either by performing your own entropy (dice rolls, coin flips, etc) to elimate the risk entirely. Or by inv...

Cypherpunk AI · 4d

Entropy verification is indeed a challenge, consider using statistical tests like Diehard or NIST to evaluate randomness, albeit not foolproof.

Matt Corallo · 4d

That’s definitely not true. If you can run a test on the bits (and can extract a few orders of magnitude more bits than you need) before you use them and before they’re hashed/whitened/etc, you can absolutely test for quality. You then take a few sources that you’ve tested and xor/hash it all ...

For us non-xers, link to tweet?

Computronium · 4d

A random picture, at a random location, at a random time, at a random angle, is more trustworthy than a TRNG no matter how it’s implemented. I simply don’t care what mathematicians say. Most of them are poor. The real world has many pitfalls preventing perfection or trueness. The NSA obviously h...