{"id":1750,"date":"2013-04-20T17:19:19","date_gmt":"2013-04-20T07:19:19","guid":{"rendered":"http:\/\/www.somethinkodd.com\/oddthinking\/?p=1750"},"modified":"2013-04-20T17:21:08","modified_gmt":"2013-04-20T07:21:08","slug":"1750","status":"publish","type":"post","link":"https:\/\/www.somethinkodd.com\/oddthinking\/2013\/04\/20\/1750\/","title":{"rendered":"Security Notice: Chasey It Selection Protocol"},"content":{"rendered":"<p>This is an analysis &#8211; and a proof of cryptographic weakness &#8211; of a master\/slave-like selection protocol that has been embedded into a number of playground games.<\/p>\n<p>To decide who is &#8220;it&#8221; (or &#8220;in&#8221;) first, in a playground game, such as chasey (a.k.a. tag), a fixed algorithmic process is used to make a pseudo-random choice.<\/p>\n<p>The players stand in a circle, and one self-selected player (a.k.a. &#8220;bossy-boots&#8221;) starts on the left and points to each player one at a time, clockwise, while reciting a traditional rhyme whose original meaning has been lost.<\/p>\n<blockquote><p>Ip dip dog shit, you are not it.<\/p><\/blockquote>\n<div class=\"aside\">What genius poet managed to rhyme &#8220;it&#8221; with not just &#8220;shit&#8221;, but, transitively, &#8220;dip&#8221; and &#8220;ip&#8221;, will alas, probably never be known.<\/div>\n<p>Of course, this is a deterministic procedure, and we can, with diligence, careful calculation, computational power and just a little bit of luck, reverse engineer the algorithm and determine who will be eventually selected.<\/p>\n<p>Let the n players be labelled 0..n-1, where the first indicated player (i.e. &#8220;Ip&#8221;) is player 0, and n >= 2.<\/p>\n<p>Define <code>out(n)<\/code> as the player who is immediately eliminated, for n >= 2.<\/p>\n<p>Note the verse has eight words. The player pointed to on the eighth syllable (i.e.<code>(8 - 1) mod n<\/code>) is eliminated.<\/p>\n<p>So, <code>out(n): (8 - 1) mod n<\/code><\/p>\n<p>In the simplest case, note <code>out(2) = 1<\/code>. That is, the player who is not initially pointed at is out.<\/p>\n<p>Define <code>in(n)<\/code> as the player who is eventually selected, for n >=2.<\/p>\n<p>Again, in the simplest case, <code>in(2) = 0<\/code>. The player who is initially pointed at is in.<\/p>\n<p>For larger n, the process is to eliminate the out player, and then restart the numbering from the player to the out player&#8217;s left, with one less person.<\/p>\n<p>Counting from the outed player&#8217;s perspective, the player to their left is player 0 (for the subsequent round), and the player that is eventually selected is <code>in(n-1)<\/code>. Changing the point-of-reference to the initial positions, the player that is eventually selected is <code>out(n)+in(n-1) mod n<\/code>.<\/p>\n<p>That is:<br \/>\n<code><\/p>\n<pre>\r\n\tin(n):  0, if n=2.\r\n\t        out(n)+in(n-1) mod n, for n>2.\r\n<\/pre>\n<p><\/code><\/p>\n<p>School-children should keep that recursive function in mind when deciding where to stand compared to the bossy counter.<\/p>\n<p>A follow-up question becomes &#8220;When is it favourable to step up, and self-nominate as &#8216;bossy-boots&#8217;?&#8221;<\/p>\n<p>Define <code>is_bossy_in(n)<\/code> as true, if the person starting the count-off is in, else false.<\/p>\n<p>Now, the count traditionally starts to the left of the bossy-boots, so the position of the bossy-boots is n-1.<\/p>\n<p>Thus, <code>is_bossy_in(n): in(n) == n-1<\/code><\/p>\n<p>In practice, <code>is_bossy_in(n)<\/code> is true only for n=3, 13, 15 and 26. No other value for n < 1000 has been discovered by researchers.\n\nThus, players wishing to game the system by avoiding being it can (after quickly checking n is not a member of a small set)  nominate themselves as bossy-boots and avoid detection by visible counting positions or unseemly, last-minute scrambles.\n\nHere is a chart of precalculated values (presented as an image because of a WordPress bug, which is also affecting formatting below... weird.)\n\n<a href=\"http:\/\/www.somethinkodd.com\/oddthinking\/wp-content\/uploads\/2013\/04\/chasey.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/www.somethinkodd.com\/oddthinking\/wp-content\/uploads\/2013\/04\/chasey.png\" alt=\"Precalculated In\/Out Positions\" width=\"272\" height=\"639\" class=\"alignleft size-full wp-image-1765\" \/><\/p>\n<p>It is expected that trivial modifications to the rhyme, such as &#8220;Ip dip dog shit, Fucking bastard dirty git, You are not it.&#8221; sometimes used in the older schools or any of the &#8220;Eeny, meeny, miny, moe&#8221; variations will have similar vulnerabilities, despite approximately doubling the bits-depth of the encryption. The definition of <code>out(n) <\/code> just needs to have the appropriate word count (or syllable count, depending on the counting scheme) substituted in, and the calculations re-run.<\/p>\n<p>Further research is required into the apparent bias against the initial position, and relative safeness of the odd positions.<\/p>\n<p><em>Note: Disclosure of the security vulnerabilities in this game was done responsibly, by informing a school teacher of the risks. After a reasonable period without action taken, it was determined that full publication was in the public interest.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>To decide who is &#8220;it&#8221; (or &#8220;in&#8221;) first, in a playground game, such as chasey (a.k.a. tag), a fixed algorithmic process is used to make a pseudo-random choice.<\/p>\n<p>Of course, this is a deterministic procedure, and we can, with diligence, careful calculation, computational power and just a little bit of luck, reverse engineer the algorithm and determine who will be eventually selected.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_s2mail":"yes","footnotes":""},"categories":[31,30,25,27],"tags":[367],"class_list":["post-1750","post","type-post","status-publish","format-standard","hentry","category-geek","category-humour","category-insufficiently-advanced-technology","category-thoughts-from-the-shower","tag-securityhumour"],"_links":{"self":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/posts\/1750","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/comments?post=1750"}],"version-history":[{"count":23,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/posts\/1750\/revisions"}],"predecessor-version":[{"id":1774,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/posts\/1750\/revisions\/1774"}],"wp:attachment":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/media?parent=1750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/categories?post=1750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/tags?post=1750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}