On Sat, 2016-05-07 at 19:41 +0000, lukep wrote: > It's hard to guarantee that any fixed, finite amount of SHAKE > output will be sufficient for any rejection sampling method > like gen_a. Isn't some small multiple usually enough? I think 1024 is large enough to tend towards the expected 42%ish failures. Also, can't one simply start the sampling over from the beginning if one runs out? I've no idea if an maybe an arithmetic coding scheme would be more efficient. > Or let a be a system-wide parameter changing say on a daily basis? I mentioned using the Tor collaborative random number generator for a in my other message, but only as feint to get to the meat of my argument that Isis and Peter's proposal sounds optimal. I think rotating a network wide a would get messy and dangerous in practice. If bandwidth is an issue, then a could be derived from the ECDH handshake, thereby making it zero cost. Jeff
Attachment:
signature.asc
Description: This is a digitally signed message part
_______________________________________________ tor-dev mailing list tor-dev@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev