Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

During the handshaking of an SSL connection, the server sends its public key, the client generates a random password, encrypts it with the pk, and sends it back, then the server decrypts it and all is well.

But, given that all (as far as I know) psuedo random number generators use the current time for the seed, given a suitable timing bias of a few minutes, could an attacker guess the random key by trying every seed in a given range?

Yes, its several billion/trillion seeds, but given that there are password hashers that can try 350 billion passwords per second, this doesn't seem to be much of an issue (i know this seems apples and oranges, but the techniques are interchangeable)

share|improve this question
A cryptographic PRNG uses far more than the time as seed and is usually unguessable. Unfortunately some implementations are broken, producing predictable outputs. Distinguishing good and broken implementations is quite hard. – CodesInChaos Sep 20 '13 at 11:01
up vote 2 down vote accepted

You are misinformed: normal PRNG do not use only the current time as seed. Indeed, if they would just do that, then the weakness you allude to would be glaring. In fact, it indeed glared, back in 1996: the then-leading Web browser, Netscape, was using a combination of the current time and its process ID as seed for its PRNG.

Nowadays, computers seed their internal PRNG with a lot of "hardware events" from which it is assumed that some entropy can be extracted. Current time is used, not as a source of randomness (it is not random), but as a way to measure the events. For instance, one can time (to the nanosecond, using the CPU cycle counter) the moment that any hardware interrupt occurs; since key strokes and mouse movements trigger IRQ based on the biological user of the computer, the exact times at which these appear are deemed unpredictable by adversaries.

Other sources may include, for instance, webcams: a picture from a webcam, even facing a blank wall, has a bit of thermal-induced noise which will alter the least significant bit of some pixels. Such noise is stochastic in nature, and gain defies predictability.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.