Re: Random #'s via CD-ROM?

["Perry E. Metzger" <perry@snark.imsi.com>]

Michael Brandt Handler says:
> 	[1] Read a pseudo-random section from the CD-ROM. Unless you catch
> the blank end of a sector, you should obtain random data (this is one
> obvious problem with this method).

How do you pick the random section in the first place? Oh, I see, we
use a random number generator!

Ahem.

Its very hard to determine if a pseudrandom number generator is "good
enough" for cryptographic purposes. Many generators that look "good
enough" for doing normal work fail miserably for cryptography. If one
is using, say, a one-time pad, one has a need to generate a large
number of truly random numbers quickly. Hacked up schemes usually
don't cut it when thats the case.

If you only need a few bits, you might as well use a non-deterministic
process outside of the program's control, like a user tapping a key.
However, for work requiring significant numbers of bits, ad-hoc
methods fail miserably.

> 	Place an *audio* CD in the CD-ROM drive. Most CD-ROM drives know
> about audio discs now, and I believe they can be made to read the binary
> waveform data even if they don't understand the Red Book audio
> format.

If you are going to use this for cryptography, is an ancient cipher
known as a book cipher, updated to use CD-ROMs. This is NOT a secure
way to encrypt things. Although its probably better than most silly
schemes people come up with, it isn't as good as real cryptosystems,
and they are available, so why use such a hack?

> 	What do you all think?

I think its good that you are evincing enthusiasm, but I really think
you ought to learn more cryptography. Remember, most obvious ideas
have already been thought of -- others are often as bright as you are,
and have come before you. Ask yourself why someone else hasn't done it
before proposing things.

Perry