Hacker News Reader

Comment by gnfargbl | Hacker News Reader

Consider an 8-bit RNG.

By your argument, it would not be a problem if the RNG never generated 0. So, it must follow that it would also not be a problem if it never generated {1, 2, 3, ..., 253}.

That means that our RNG now only generates the values 254 and 255. Which of the values is generated is unpredictable on any given call. However, 7 of the 8 output bits are now always fixed and so completely predictable. Can you imagine how an attacker could exploit that?

Failing to generate only the number 0 is a weaker version of the same class of flaw.

View on HN

This is the “what’s the big deal if I lost $100k in a casino, it’s really the same thing as if I had lost $5” argument.

I don’t think you can rebut “you only lose one of many values” with “it’s the same as only having one left”.

We're talking about whether a modification of the expected probabilities changes the dynamics of the game. The example I gave was deliberately extreme, because that makes it easier to reason about.

If you want a casino example, then consider a roulette wheel that always lands on 36 but still pays out as usual. I think you'd want to play on it. Now consider one that always lands somewhere between 30 and 36. Still worth it, right? With careful bets and a good starting float you're still coming away from the table up (with a very high probability).

In fact for a roulette wheel you only need two dead pockets for the player to get an edge. Bias is exploitable.

Sure, but you’re pressing on the truth that a small modification taken to an extreme is a large modification.

When the original point was that a tiny fractional loss in an RNG is not going to make a practical difference. Which I believe is also true. And it is also true that a large loss in an RNG is catastrophic.

They can both be true.

And roulette is 2 out of 38, 5.2%. That’s 17 times more than the 1/256 here, which was already a simplification of the (I think) 1/65536 in question.

With respect, I think you're still missing my point, which is simply that bias introduces vulnerability. Without a real scenario to analyze, the scale doesn't really factor into the argument. A vulnerability is a vulnerability until proven mitigated.

> a tiny fractional loss in an RNG is not going to make a practical difference

I'm not so sure this is true. I don't think either of us is in a place to say whether this vulnerability has practical applications or not. A 1/65536 bias might seem like nothing important to you. It seems like potentially something to me, in a world where the attacker might control the volume of data generated.

> So, it must follow

It certainly does not.

A never-zero RNG is something one should know about, so that it can be mitigated if necessary, but it's not inherently a dealbreaker.

The value space goes from 2^16, 2^32, 2^64 to 2^16 - 1, 2^32 - 1, and 2^64 - 1 respectively.

The bug has zero practical impact.

It is absolutely untrue that a biased RNG has "zero practical impact." Modern cryptography has plenty of examples of relatively small biases leading to breaks. Check out Bleichenbacher's attack, for instance.

You could be correct that the very small bias here is not enough to be exploitable. But, given the history around this, it would be wrong to handwave it away as trivial.

Some cryptographic algorithms can be broken by this sort of bias (after 2^20, 2^35, or 2^70 operations), others are completely unaffected. There's certainly no excuse for not knowing, at least.

Reply on news.ycombinator.com