[Cryptech Tech] tribyte pattern in rosc data

[Fredrik Thulin]

> On Dec 13, 2014, at 3:05 AM, Joachim Strömbergson wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA256
> > 
> > Aloha!
> > 
> > Russ, does this frequency of the pattern you find look correct?
> > 
> > Analyzed file: /Users/js/tmp/rosc_data_btsync/rosc_data.bin
> > Total number of bytes: 67121200
> > Number of patterns:    1041
> > Frequency in file:     0.000016

On Sunday, December 14, 2014 04:07:21 PM Russ Housley wrote:
> The pattern appeared 31 times in the first 40,000,000 bits.  I did not look
> any further.  So, it is appearing every million bits or so.
> 
> Russ

Hi Russ and list

I tested Joachims tri-byte analyzing script on my avalanche noise entropy data 
and strangely enough, it yielded a frequency of 0.000015 more or less the same 
as the ring oscillator output. That made me re-think what I believe should be 
the expected frequency:

If you have a dice with 256 sides, the probability to roll the same number 
twice in a row is 1 / 256. The probability to roll a pre-determined number 
(say 256) twice in a row would be 1 / 65536, but since we are just looking for 
two equal numbers following each other it would happen with a probability of 1 
/ 256.

Thus, the probability to roll the dice matching the patterns you saw should 
actually be 1 / 65536 (0.00001525) if I'm doing the maths correctly this time 
=).

31 times in the first 5,000,000 bytes (40M bits) is 0.00000620 which I don't 
think should be tripping any Consecutive Value Test. What is your 
implementations expectations for this test? Are we actually looking at the 
right bytes here or could the test for example have noticed bit patterns but 
show byte output?

/Fredrik