Comment by mitxela
4 days ago
Even if you use these directly for cryptography, most cryptography is not practically affected by being unable to receive a zero word. For instance you can choose a private or symmetric key from any random distribution you like, as long as it's got enough entropy to be unguessable. The fact that your private key can't have a zero half makes no difference because that was extremely unlikely to happen anyway.
In some protocols that rely on random input when encrypting (like the EC flaw that broke the PS3) it may cause an observable statistical bias after 2^70 encryptions or so.
With ecdsa the number of signatures needed to attack biased nonces seems low, hundreds or thousands? https://blog.trailofbits.com/2020/06/11/ecdsa-handle-with-ca...
That's when you have at least one bit of each nonce. But if you think about it, the probability of this broken generator giving exactly the same output as the unbroken generator is (2^64-1)÷(2^64) so that's a lower bound on how often you don't get any information from this bias. (Assuming 64-bit generation!)
getting any information at all based on this bias