What is nonsense about dice? If you're insinuating that 50 rolls equating to ~128 bits of entropy is crackable, then the entire security model is broken on its face.
Am I the only person in the world who's played Yahtzee? I've rolled thousands of dice at this point and it's never been difficult, not one time.
Replies (5)
You're making the same mistake again; I don't have time to argue.
I'm not arguing. I'm just telling you you're wrong. The DICE Entropy Addition software is open source and comparable to other iterations, producing the same results from the same base key. Zero trust involved.
Either he's saying dice are stoneage tech and thus silly or that you can still fuckup entropy generation if you don't know what you're doing. For the latter, you can do this by having insufficient rolls. Since each six sided die has log2(6) = 2.58 bits of entropy, to get 128 bits you need to roll 50 times (128/2.58 = 49.61) and then pass the roll data (e.g., "623415325...") into a crytographic hash function with at least 128 bit output (e.g. SHA256). If you don't use a hash because of modulo bias, the entropy per roll is only 1.67 bits so you need 77 rolls. Some people might even just roll 10 times or whatever and think it's secure. Point is, you still can fuck it up.
Yeah, I know what he's saying, I am also saying I have walked people through this process about a dozen times and no one said "Wait I have to roll the dice then add it to the program input? I'm SO CONFUSED?!?!"
This is simple shit, I say roll 100 times, you roll 100 times, you get a secure, sufficiently entropic seed.
Yeah, I guess he thinks it seems basic and dumb to have to use dice then. Would be nice if he responded in case he does have some good reason.
