lukevalenta

5 ms·

1.
by lukevalenta 2y ago
Here's how you can get that entropy using the Shannon entropy equation from https://en.wikipedia.org/wiki/Entropy_(information_theory) . Like you said, the probability of any digit appearing is 1/30, and there
2.
by lukevalenta 3y ago
Some folks from Chainsafe looked into it a couple years ago: https://github.com/nulltea/zk-timelock . I'd love to see this work move forward.
3.
by lukevalenta 3y ago
Hi, I'm one of the authors of the Cloudflare blog and maintainer of Cloudflare's drand nodes. You're correct -- after the initial distributed key generation, the values produced by the drand network are deterministic (this is
4.
by lukevalenta 3y ago
Randomness from a CSPRNG (cryptographically-secure random number generator) never really gets "depleted," since as long as the seed contains enough entropy and isn't compromised, then it's computationally infeasible to l
5.
by lukevalenta 3y ago
The piece that helps security-wise is that we're mixing in entropy from a trusted external source, so not solely relying on the local random number generation from a machine in a data center somewhere. Is it likely that local random nu
6.
by lukevalenta 3y ago
As long as it's done correctly, mixing new entropy sources into an entropy pool will never _decrease_ the entropy. So in the case of LavaRand, even if it only ever returned a string of zeros, systems that mix it's output into thei
7.
by lukevalenta 5y ago
Correct. Anonymizing the U2F device hides the device manufacturer information, which is currently required for Cloudflare to verify that the device comes from a trusted vendor. From the blog post: > Cloudflare asks you for proof and chec
8.
by lukevalenta 5y ago
Regarding your second point, this is meant to be a CAPTCHA alternative, not full replacement. Users without access to approved devices should be able to fall back to existing proof of personhood mechanisms. It's good to have options!