Re: Testing randomness

> Haven't seen much traffic here since I subscribed, but it seems like the
> most likely place to get help with my little problem.
> 
> I recently released Net::Random to the CPAN.  It retrieves data from
> online sources of truly random data (so they claim).  I'm quite happy to
> believe that those data really are random, but I'm not so happy to
> believe that the results of my module are random, because I do some
> processing of the data to ensure that the user only gets random values
> in a range he has specified.  Any error in my code - off-by-one errors
> for instance - could introduce bias.
> 

Well this doesn't get to your question about testing randomness, but is
a question about Net::Random as it may pertain to crypto since this is
the crypto list and it is low traffic ;-)...

It appears that the data is retrieved from an external source over plain
http??  In a secure application doesn't this inherently destroy the
security?  The randomness source is insecure by its nature which would
allow spoofing attacks of the randomness which would naturally allow
non-randomness to be used against any encryption scheme??

As far as it being an easy way to get random numbers it sounds pretty
cool, but from a security aspect it is susceptible, which might be
pointed out in the docs...

Good luck with the testing!

http://danconia.org