Re: Good enough for crypto?

In message <[EMAIL PROTECTED]>, Ernst Lippe 
<[EMAIL PROTECTED]> writes
> On Wed, 26 Nov 2003 16:05:14 +0000, Richard Herring wrote:
>
> > In message <[EMAIL PROTECTED]>, Ernst Lippe
> > <[EMAIL PROTECTED]> writes
> > > On Tue, 25 Nov 2003 17:06:24 +0000, Richard Herring wrote:
> > >
> > > > In message <[EMAIL PROTECTED]>, Ernst Lippe
> > > > <[EMAIL PROTECTED]> writes
> > > > [...]
> > > >
> > > > > Normally, when people are talking about "the entropy of a source" what
> > > > > they mean is the entropy of the best possible statistical model of
> > > > > that source.
> > > > >
> > > > > Perhaps, some examples will make this clearer. Suppose that you
> > > > > have an entropy (bit)source, for which you can show that it is unbiased
> > > > > and that successive bits are independent. The best model for this
> > > > > source is a binomial distribution with p= 0.5. The entropy from
> > > > > this model is 100%, every output bit contains 1 bit of entropy.
> > > > >
> > > > > Now let's take the bits in the value of pi. When you assume that the
> > > > > best model is again the binomial distribution, the entropy in these
> > > > > bits is again 100%. However, when you assume that the best statistical
> > > > > model is the binary expansion of pi, you can always predict the next
> > > > > bit, so the entropy under this model is zero.
> > > >
> > > > If pi is normal, this is true for _any_ sequence of bits ;-)
> > > >
> > > > Finding the starting point is left as an exercise for the reader.
> > >
> > > The total entropy of any PRNG is equal to the amount of information
> > > in its parameters. In this case the only parameter is the starting
> > > point. Because the total entropy for any PRNG is fixed, the average
> > > entropy per output bit will always go to zero when you take longer
> > > output sequences.
> >
> > Of course. But who mentioned a PRNG? "Binary expansion of pi" is the
> > model, not the generator.
>
> Oh, now I see what you mean. Still your statement is a bit imprecise
> it is only true for finite sequences.

Sorry, I should have made that clearer.

(OTOH when was the last time anyone generated an infinite sequence for 
you to model? ;-)

--
Richard Herring