Hacker News Reader

Comment by tczajka | Hacker News Reader

If a predictable PRNG is sufficient for wiping disks, why do we care that the data is random at all? How about writing 0, 1, 2, ..., 255, 0, 1, 2, ... to consecutive bytes? Or -- generate 1 kb of good quality random data, and write the same 1 Kb repeatedly? It's not clear to me what we're trying to achieve in this scenario.

View on HN

Because it is conceivable that you could extract patterns from the underlying data because you know what the highly correlated, short-cycle writing pattern was.

In reality, genuinely writing (as opposed to just pretending it was written which is a hazard on any modern storage) any single byte (even just all 0 or all 255) to every position on the disk seems to be more than sufficient to thwart even the NSA.

Isn't it also similarly conceivable that if you write a predictable PRNG sequence such the outputs of Mersenne Twister you could also potentially extract patterns? Mersenne Twister is essentially as predictable as a short cycle.

Correlating a short cycle is much more difficult than correlating a long cycle even if you have complete information about the long cycle. If the bits on the disk have a pattern, it is much more likely to repeat against a short cycle.

However, as I pointed out, it's all pretty much moot. I've never seen anybody cough up evidence that a disk could be recovered after even a single write with merely zeroes. In fact, there was a competition and prize for a while that could be won if you could demonstrated reconstruction of a disk after even a single platter write. Nobody ever managed to claim it.

What you just described is, in theory, just a really bad non-CS PRNG. In that sense we are in agreement that a CSPRNG is not necessary.

To your point, a non-CS PRNG seeded with a static value isn’t “random at all”.

This is why they are sometimes called DRBGs: deterministic random bit generators. You just described two such functions.

> This is why they [non-CS PRNGs] are sometimes called DRBGs

CSPRNGs are also sometimes called DRBGs. Classically, "Dual_EC_DRBG" but also NIST SP 800-90A "(AES_)CTR_DRBG," which is what the Windows 10 kernel random device uses.

If this is sufficient, then this matches what I said in the article. I wrote that if you don't care about what numbers you get, don't bother with xoroshiro or Mersenne Twister, just use https://xkcd.com/221/.

Reply on news.ycombinator.com