Re: Good enough for crypto?

On Wed, 26 Nov 2003 16:05:14 +0000, Richard Herring wrote:

> In message <[EMAIL PROTECTED]>, Ernst Lippe 
> <[EMAIL PROTECTED]> writes
>>On Tue, 25 Nov 2003 17:06:24 +0000, Richard Herring wrote:
>>
>>> In message <[EMAIL PROTECTED]>, Ernst Lippe
>>> <[EMAIL PROTECTED]> writes
>>> [...]
>>>
>>>>Normally, when people are talking about "the entropy of a source" what
>>>>they mean is the entropy of the best possible statistical model of
>>>>that source.
>>>>
>>>>Perhaps, some examples will make this clearer. Suppose that you
>>>>have an entropy (bit)source, for which you can show that it is unbiased
>>>>and that successive bits are independent. The best model for this
>>>>source is a binomial distribution with p= 0.5. The entropy from
>>>>this model is 100%, every output bit contains 1 bit of entropy.
>>>>
>>>>Now let's take the bits in the value of pi. When you assume that the
>>>>best model is again the binomial distribution, the entropy in these
>>>>bits is again 100%. However, when you assume that the best statistical
>>>>model is the binary expansion of pi, you can always predict the next
>>>>bit, so the entropy under this model is zero.
>>>
>>> If pi is normal, this is true for _any_ sequence of bits ;-)
>>>
>>> Finding the starting point is left as an exercise for the reader.
>>
>>The total entropy of any PRNG is equal to the amount of information
>>in its parameters. In this case the only parameter is the starting
>>point. Because the total entropy for any PRNG is fixed, the average
>>entropy per output bit will always go to zero when you take longer
>>output sequences.
> 
> Of course. But who mentioned a PRNG? "Binary expansion of pi" is the 
> model, not the generator.

Oh, now I see what you mean. Still your statement is a bit imprecise
it is only true for finite sequences.

greetings,

Ernst Lippe