Is a rand from glibc's rand secure for a login key?

Question

Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?

Answer 1

No. The PRNG in typical C libraries is designed for speed, not for security. It's usually appropriate for numerical simulations and games (in good-quality implementations — there are implementations out there, mostly old ones, where it's not appropriate for anything), but not for cryptography. A cryptographic PRNG must be unpredictable, i.e. an attacker who generates a series of numbers must not be able to make a good guess at the next number. The typical C library PRNG strives for speed and good statistical properties but not for unpredictability.

As of Glibc 2.7, rand and friends use a linear congruential PRNG or a linear feedback shift register depending on the available seed length.

To generate key material or any other random number involved in cryptography (including non-secret things like nonces that nonetheless need to be unpredictable), obtain all bits from a crypto-quality RNG. Linux's /dev/urandom (or any other unix that has /dev/urandom) is fine for that. You must use it for each byte of each key; using it as a seed of the C library PRNG is not good (there would be a strong correlation between the keys). A library such as OpenSSL is another choice; it'll probably use /dev/urandom under the hood as a seed but may be a little faster if you're generating large volumes of random data.

Answer 2

No! rand() is totally insecure. Using rand() for this purpose has caused major vulnerabilities in major systems.

Just use /dev/urandom.