State an attacker experiment Passive observation tests confidentiality. Accepted modifications test integrity/authenticity. Replay needs freshness even when the original message is authentic. These toy implementations teach mechanics, not a deployable protocol. 2 / 7
Separate state from output Seed 1 → saved XorShift state 0x2000001. Multiplied uint64 output: 0x47e4ce4b896cdd1d. Save the pre-multiplication state. Uniform-looking output does not establish unpredictability. 3 / 7
Count the modulo bias Three-bit draw modulo 3: residue counts [3,3,2]. Accept 0..5, reject 6 and 7: counts [2,2,2]. Contract cutoff M-(M%n) accepts r<limit, not r<=limit. An unbiased mapping cannot repair a predictable source. 4 / 7
Birthday estimate and representability q(q-1)/2 pairs; p≈1-exp(-q(q-1)/(2×2^b)). b=8, target=0.5: q=19 is below, q=20 above. Use Log1p, return at least 2 for positive targets. Saturate before int conversion; maxInt can mean unrepresentable. 5 / 7
Pad reuse exposes a relation c1 XOR c2 = p1 XOR p2. With known p1, recover p2 by one more XOR. Without known plaintext, both messages are not automatically revealed. Nonce requirements differ: unique CTR counters, unpredictable CBC IVs. 6 / 7
Reconstruct Four-bit source, n=5: derive cutoff and residue counts. p1=a0, c1=0f, c2=3c: recover p2. Explain why toy PRNG plus rejection sampling remains unsuitable for secrets. 7 / 7