So what? The point is to be non predictable not to pick all the numbers in the range with exactly the same probability. Would it be a problem if it never generated 16542?

▲

gnfargbl 2 hours ago | parent | next [-]

Consider an 8-bit RNG.

By your argument, it would not be a problem if the RNG never generated 0. So, it must follow that it would also not be a problem if it never generated {1, 2, 3, ..., 253}.

That means that our RNG now only generates the values 254 and 255. Which of the values is generated is unpredictable on any given call. However, 7 of the 8 output bits are now always fixed and so completely predictable. Can you imagine how an attacker could exploit that?

Failing to generate only the number 0 is a weaker version of the same class of flaw.

▲

brookst an hour ago | parent | next [-]

This is the “what’s the big deal if I lost $100k in a casino, it’s really the same thing as if I had lost $5” argument.

I don’t think you can rebut “you only lose one of many values” with “it’s the same as only having one left”.

	▲	gnfargbl an hour ago \| parent [-]
		We're talking about whether a modification of the expected probabilities changes the dynamics of the game. The example I gave was deliberately extreme, because that makes it easier to reason about. If you want a casino example, then consider a roulette wheel that always lands on 36 but still pays out as usual. I think you'd want to play on it. Now consider one that always lands somewhere between 30 and 36. Still worth it, right? With careful bets and a good starting float you're still coming away from the table up (with a very high probability). In fact for a roulette wheel you only need two dead pockets for the player to get an edge. Bias is exploitable.

▲

throwawayffffas an hour ago | parent | prev [-]

The value space goes from 2^16, 2^32, 2^64 to 2^16 - 1, 2^32 - 1, and 2^64 - 1 respectively.

The bug has zero practical impact.

	▲	gnfargbl an hour ago \| parent [-]
		It is absolutely untrue that a biased RNG has "zero practical impact." Modern cryptography has plenty of examples of relatively small biases leading to breaks. Check out Bleichenbacher's attack, for instance. You could be correct that the very small bias here is not enough to be exploitable. But, given the history around this, it would be wrong to handwave it away as trivial.

▲

antiloper 2 hours ago | parent | prev | next [-]

What are you talking about? The point is in fact to pick all the numbers in the range with exactly the same probability.

See section 7.3.17 of the Intel SDM, and how NIST SP800-90A (which the SDM refers to) defines "random number".

▲

IAmBroom 16 minutes ago | parent | prev | next [-]

"Random" is used by most people to mean "random with an even distribution".

A weighted die is still random, but with an uneven distribution. This is effectively a 2^16-sided, weighted die.

▲

swader999 2 hours ago | parent | prev | next [-]

Betty from accounting will have words.

▲

throwawayffffas an hour ago | parent [-]

What does Betty from accounting care about RNGs?

	▲	swader999 8 minutes ago \| parent [-]
		There's an edge case somewhere that will affect a real user when you can't get a zero. Forecasting simulations perhaps?

▲

Hugsbox 2 hours ago | parent | prev | next [-]

That may well be a problem, yes.

▲

wat10000 24 minutes ago | parent | prev [-]

“Predictable” and “not pick all numbers in range with exactly the same probability” are synonyms here.