Re: Good enough for crypto?

"Tom St Denis" <[EMAIL PROTECTED]> writes:

> "Scott Wilber" <[EMAIL PROTECTED]> wrote in message
> news:[EMAIL PROTECTED]
> > The binary expansion of Pi or e or Sqrt(3), i.e., any irrational
> > number may be used as a model, while the program (including the
> > computer it is running on) that actually spits out the bits is the
> > generator.  All of these generators are totally deterministic, and as
> > such produce sequences of exactly zero true entropy.  At most, the
> > sequences contain a total amount of entropy, or more specifically,
> > complexity, that is contained in the simplest program (generator)
> > needed to produce the output.  Even with this theory of entropy, the
> > per-bit entropy approaches zero as N increases without bound.
> 
> You were dancing around the right idea.  Bits don't have entropy.  Bit
> generators do.  So a program that generates the digits of pi has as much
> entropy as the shortest program that reproduces the same output.

Entropy is being measured in bits. A RNG which generates 32 bit words 
would deliver 32.0 bits of entropy with each word. And therefore it has 
a "per-bit entropy" of 1.0. Yes, the RNG's given you 32.0 bits of 
entropy, and yes, it's 1.0 bits per bit. Two different numbers, no 
contradiction. 

And I think it's funny you piping up to "correct" Scott, for as I was 
reading his post I was thinking that it was one of the clearest worded
posts on entropy I've seen in ages. I wish I could express myself so 
clearly! "Dancing around the correct idea", eh? You've misparsed his
sentence, that's all.

Phil

-- 
Unpatched IE vulnerability: HTTP error handler Local Zone XSS
Description: HTML/Script injection in the Local Zone
Reference: http://sec.greymagic.com/adv/gm014-ie/
Exploit: http://sec.greymagic.com/adv/gm014-ie/