I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
I am concerned that a SHA-1 PRNG cannot produce an AES-256 cipher key with the expected 256 bits of security, or indeed any secure cipher key where over 165 bits of security are expected. The SHA-1 ...
Due to a potential NSA backdoor, the NIST is now recommending that implementor no longer use ECC-based PRNG Dual EC DRBG. (As described in Wired.com) this PRNG has certain features such as: ...
Question: Is there a way to detect the use of a PRNG strictly from observing the output provided by an application? Background: During an audit of a key generating algorithm that I knew was based on ...
Reading about how insecure PHP's rand function is, I was wondering if it helps to combine random functions. The suggested function there, openssl_random_pseudo_bytes, can also be cryptographically ...