[onerng talk] DiceKeys looks very cool

[Jim Cheetham]

Exactly right - if you genuinely have the problem of wanting to store some
key data offline for long periods of time, then "generate them properly"
and print them out & use tamper-evident envelopes. If you have the problem
at scale, HSMs are probably in your future, sorry about that. But for an
introduction to the concept, I think these DiceKeys are actually
interesting and seem to be valid.

Dice are not 'ideal' generators, as the majority of options on the market
are made with very sloppy tolerances, which is probably what happened in
the 2014 article with hexadecimal dice not providing an even distribution -
but this is simply the same 'bias' problem that OneRNG has as well, just at
a larger scale. You can hide the bias by reducing your claim to the bits of
entropy per event and then whiten the results ... which is easier to do in
software than with the results of some dice rolls being processed by a
human.

Interestingly enough there are observable 'dice roll fatigue' effects
(can't find a reference at the moment, sorry) where humans tend to change
the amount of effort they put into a shake-and-roll and after a few
iterations it's more like a slide-onto-the-table which leads to slightly
more predictable results. So shaking all the dice in one go, via a bag or
decent cup, is the way to go.

-jim

On Thu, Sep 17, 2020 at 5:47 AM R P Herrold <herrold at owlriver.com> wrote:

> OneRNG <http://lists.onerng.info>
>
> [image: Photo of herrold]
> <http://lists.onerng.info/p/74XvCQ6RLYoPvTNiXd3VBI>
> *DiceKeys looks very cool*
> <http://lists.onerng.info/r/topic/2sfVnjQXQCQbNLtvey0guG>
> by *herrold* <http://lists.onerng.info/p/74XvCQ6RLYoPvTNiXd3VBI>
> in *OneRNG Talk* <http://lists.onerng.info/groups/onerng-talk>
> ------------------------------
> On Wed, 16 Sep 2020, Jim Cheetham wrote:
>
> > https://*www.wired.com*/story/dicekeys-cryptography/
> <https://www.wired.com/story/dicekeys-cryptography/>
> > https://*www.crowdsupply.com*/dicekeys/dicekeys
> <https://www.crowdsupply.com/dicekeys/dicekeys>
>
> fine geek toy, but seems overly complex. I threw this
> together long ago, to simply replicate a shuffling and deal,
> selection without replacement of an arbitrary input deck of
> letters, numbers, symbols, whatever. Add UC. Stack or bias
> the deck to taste. Run lots of rounds
>
> Print a screenful, and choose a line and offset with a D & D
> 20 side die for your seed. Print a sheaf of them, and toss
> the paper into the safe in a tamper evident safety envelope
>
> https://*github.com*
> /herrold/tool-tips/blob/master/convenience/shuffle-stdin.php
> <https://github.com/herrold/tool-tips/blob/master/convenience/shuffle-stdin.php>
>
> [herrold at centos8 bin]$ for i in `seq 1 20` ; do echo -n "$i " ; \
> echo "abcdefghijklmnopqurstvwxyz" | shuffle-stdin.php ; done
>
> 1 dfujagrsyitnvmcxhqzbpleowk
> 2 szgnhmdryalutwpifojekvqbcx
> 3 ehkjunfsdzmgorxlbcaiwtqyvp
> 4 pmfaijucyhqrwodvsgxzentbkl
> 5 acjsbzqohuenvixltmpdwfrkgy
> 6 bqgamshnlvidjkpuezwtycxfro
> 7 mfuasdkbxrvnqecoltjwhpizgy
> 8 ltuvkmgqwbhfyonpzdsjiecrax
> 9 pgxtveusjzfnwiahymdorbclkq
> 10 kirltwxogaudzvqmshfbypenjc
> 11 cblrdhkzfjpsotwnayxequvmgi
> 12 xudzoricjagefqnwvmhbyslptk
> 13 owblfjagvduxipkmnhzcetrysq
> 14 qvyhlafmgpijwxrtoscbdkzuen
> 15 tpvwycghzjkuafdmorsbxleinq
> 16 wtipbesdajvomncgzurlxkfqyh
> 17 bapjixtmuvrgcqhkldnyofzews
> 18 whvryjqnkbsodleuicptmfzaxg
> 19 xhykpsrdwjovblacutfeziqmng
> 20 gybmruajfeoiqtwhnklxdspzcv
> [herrold at centos8 bin]$
>
> factorial of 26 = 403291461126 605635584000 000
> Rest of post… <http://lists.onerng.info/r/post/2sfVnjQXQCQbNLtvey0guG>
> ------------------------------
> ⮪ Reply
> <onerng-talk at lists.onerng.info?subject=Re%3A%20DiceKeys%20looks%20very%20cool>
>   🖂 New topic <onerng-talk at lists.onerng.info>   View topic…
> <http://lists.onerng.info/r/topic/2sfVnjQXQCQbNLtvey0guG>
> Unsubscribe
> <onerng-talk at lists.onerng.info?subject=Unsubscribe&body=Hello%2C%0A%0APlease%20remove%20me%20from%20OneRNG%20Talk%0A%3Chttp%3A//lists.onerng.info/groups/onerng-talk%3E%0A%0AThank%20you.>
>  •  Switch to a daily digest
> <onerng-talk at lists.onerng.info?subject=Digest%20on&body=Hello%2C%0A%0APlease%20switch%20me%20from%20receiving%20one%20email%20per%20post%20to%20the%20daily%0Adigest%2C%20which%20summarises%20the%20all%20the%20posts%20made%20each%20day%20in%0AOneRNG%20Talk%0A%3Chttp%3A//lists.onerng.info/groups/onerng-talk%3E%0A%0AThank%20you.>
>
>    - Privacy <http://lists.onerng.info/policies/privacy/>
>    - Acceptable Use <http://lists.onerng.info/policies/aup/>
>    - Terms of Service <http://lists.onerng.info/policies/tos/>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ourshack.com/pipermail/discuss/attachments/20200923/2b267dc9/attachment.html>