The generation of random or pseudorandom data, and the use of randomness in security protocols
2
votes
1answer
65 views
isaac random number generator and the type of encryption it is used for (game packet encryption)?
I recently found isaac but I'm not sure what type of encryption is possible using it. Does the random number generator itself become the message somehow or does it get used as a seed for an encryption ...
4
votes
1answer
70 views
Tools and methods for analyzing RNGs
What are the common tools and methods used for analyzing and attacking Random Number Generators?
I know what characteristics make a good RNG and what a good RNG should do but I do not know how to ...
12
votes
3answers
221 views
What statistics can be used to identify pseudorandom data?
I'm working on some code that attempts to identify files whose contents appear to be "random". As such, I'm looking for statistical measures that can be used to identify such randomness.
I've ...
0
votes
1answer
226 views
Java SecureRandom generate secure random number
How to generate a secure random number bit length is 256 bits using Java. What is the different between:
SecureRandom random = new SecureRandom();
and
SecureRandom prng = ...
6
votes
1answer
198 views
How to predict C rand()? [duplicate]
Is there a practical way to predict previous/next C rand() output if i have some of the values? How many values do i need? Do they need to be consequent? If it depends on compiler - for which ...
7
votes
3answers
649 views
Generating random passwords by clicking randomly on the keyboard?
How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ?
I usually need random strings for salts and for passwords, and I ...
1
vote
2answers
222 views
How to generate a highly unpredictable random bytes
void
vncRandomBytes(unsigned char *bytes)
{
int i;
unsigned int seed = (unsigned int) time(0) + getpid() + rand();
srand(seed);
for (i = 0; i < CHALLENGESIZE; i++) {
bytes[i] = (unsigned ...
5
votes
1answer
101 views
Detecting PRNG Use from Output
Question: Is there a way to detect the use of a PRNG strictly from observing the output provided by an application?
Background: During an audit of a key generating algorithm that I knew was based on ...
5
votes
3answers
244 views
CSRF Countermeasures
I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated ...
6
votes
2answers
245 views
Filling the disk with random data prior to encryption?
Filling the disk with random data prior to encrypting it will supposedly make it harder for the attacker to perform any cryptanalysis. Most sources seem to state this is because it will be harder for ...
1
vote
2answers
462 views
should i use urandom or openssl_random_pseudo_bytes?
I am developing a site in php 5.4 and i was wondering which is better to use to gen a random salt for password security?
$salt = sha1(openssl_random_pseudo_bytes(23));
or
$seed = '';
$a = ...
5
votes
2answers
191 views
How is the available entropy in /dev/random calculated (or estimated)?
It seems (to a non-expert) that /dev/random is acclaimed to be useable as a source of pure random data. However, I am curious as to the analysis of the file /dev/random.
/dev/random is a collection ...
10
votes
3answers
411 views
Is a predictable MAC address a risk?
If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will ...
1
vote
0answers
46 views
Do the popular smartphone operating system have a cryptographically secure random source? [duplicate]
Possible Duplicate:
Do mobile OS’s provide crypto-quality randomness?
Linux and Mac OS X has /dev/urandom, Windows has CryptGenRandom.
Do iOS and Android have a similar way to generate ...
-5
votes
3answers
370 views
create a variants of MD5
I have also asked similar q here :
To create a variants of MD5, I made following changes :
MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32)
Instead ...
4
votes
1answer
103 views
Computational Feasibility of finding 'Good Links' of the following format
I recently stumbled upon this and am checking here to see if what I am proposing is indeed feasible and can be considered a breach of privacy.
For obvious reasons I am not revealing the website ...
7
votes
4answers
653 views
Generate cryptographically strong pseudorandom numbers in Javascript?
Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript?
The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
3
votes
4answers
277 views
SMS Authentication: random OTP or a cryptographic one
I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest:
Sending random 8 ...
3
votes
3answers
223 views
PRNG: Does combining insecure algos help?
Reading about how insecure PHP's rand function is, I was wondering if it helps to combine random functions. The suggested function there, openssl_random_pseudo_bytes, can also be cryptographically ...
3
votes
3answers
1k views
How insecure are PHP's rand functions?
There are some pseudo-random-number generators in PHP: rand(), srand(), mt_rand(), mt_srand(). You can look at their code here.
I understand those functions are insecure, but how insecure are they?
...
8
votes
4answers
480 views
How insecure are non-cryptographic random number generators?
I always hear that C rand() is not secure, but what how many calls would you need to know in order to predict the next value (or at least cut down the possibilities)? Would they have to be sequential? ...
16
votes
5answers
401 views
Hashed password storage with random salt
Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
4
votes
2answers
273 views
Can I use hardware random number generation on my computer? Am I already using it?
A lot of computer security depends on encryption: SSL connections, TCP packet sequencing, encrypted files, etc. These depend on random number generation to ensure that attackers can't guess the ...
7
votes
1answer
1k views
How to select /dev/random or dev/urandom in the code in Android?
When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
6
votes
4answers
1k views
What do I need to configure, to make sure my software uses /dev/urandom?
When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random?
Some servers don't have much entropy in the entropy pool ...
2
votes
1answer
500 views
Requirements for a secure session id?
I'm writing a web service which stores data which will be shared between two
separate systems.
/session/requestNewSession?args=<data> => returns session id
...
3
votes
3answers
360 views
Pseudo Random Generator is not initialized from the (entropy pool)?
The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block.
But when ...
1
vote
1answer
198 views
What are the requirements for a random number generator to a be safe to use in cryptography?
When I look at most RNG's (random number generators), I see a disclaimer that looks similar to this:
Caution: Mersenne Twister is basically for Monte-Carlo simulations - it is not ...
0
votes
2answers
220 views
What are the pitfalls while generating a random number from a random data set?
I am relatively new to the GPG key system and I have been been learning about the system through experimentation. I now know that while generating a random seed for the key generation, the random ...
-1
votes
4answers
140 views
pesudo random password
I post a question before about one password repeating to make it longer, now its a new way want to ask about, if take the word 'secure' and instead of repeating it put somenumbers between it, exp: ...
6
votes
2answers
136 views
What to consider when generating random code as part of two-factor authentication?
I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
9
votes
3answers
2k views
What are you doing when you move your mouse randomly during a truecrypt volume creation?
Is that called a 'round' every time you move your mouse when creating a new volume? I'm talking about the screen with the random numbers during the volume creation process. What is the purpose of ...
4
votes
2answers
164 views
What factors increase the probability of duplicating a GUID?
It's been argued that a GUID doesn't do a good job of being a one time security token , and it makes sense because GUIDs aren't random.
In my scenario: suppose a given company is using GUIDs as a ...
8
votes
2answers
2k views
Can the numbers on RSA SecurID tokens be predicted?
My workplace uses these SecurID tokens which provide you with a temporary password, the code will expire after a short time. I have always been fascinated by the things, because it seems as though ...
3
votes
1answer
296 views
Should I include a random padding in every HTTPS request and response?
According to the following paper, it is possible to decrypt HTTPS traffic by inspecting AJAX calls and using the size parameter as a cryptographic oracle.
Should I be sending a variable length ...
4
votes
1answer
883 views
OpenSSL RAND_poll 'good enough'
We are using OpenSSL for generating IV's and other random data. We initialize it using RAND_poll and, on Windows, RAND_screen.
The question is though, if the seed generated by those methods is good ...
4
votes
1answer
169 views
Random number for HTTPS Message Authentication Code (MAC)
Recently I found that Netscape used quite simple algorithm to generate random number for Message Authentication Code to establish an HTTPS connection (Netscape used time, process identification ...
10
votes
3answers
516 views
Cryptographic Security of Dynamically Generated, Non-Random Salts
So when it comes to security, when I have an idea that seems good, but no one else seems to be doing, I try to assume that I'm overlooking something obvious or otherwise significant. This is one such ...
3
votes
2answers
956 views
/dev/random security holes
I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
11
votes
2answers
701 views
Flaw in encryption through pseudorandom number stream (from gpg documentation)
I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity:
When I was in college in the early 70s, I devised what I believed was a brilliant ...
7
votes
5answers
542 views
Should passwords be truly random?
When generating a password, should it be "truly random" or should I make it a little less random by enforcing some rules?
If a password is generated at random, it could come out all-lowercase letters ...
3
votes
2answers
562 views
Is this algorithm for a random string cryptographically secure?
I've pieced together this algorithm (if it can be called that) from various bits of code I've seen online, and I'm wondering how cryptographically secure it is. It's used to generate passwords:
...
14
votes
2answers
1k views
Is “real salt” the same as “initialization vectors”?
In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
5
votes
1answer
272 views
Asynchonous Linear Feedback Shift Register : test vectors
Well I've been working on coding LFSR structures for my research projects.
Being able to find sources on the subject, I've been able to test a single LFSR with different initialisation and TAP ...
7
votes
2answers
337 views
Is a rand from glibc's rand secure for a login key?
Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
10
votes
4answers
945 views
Using computer random number generators to produce keys, it is secure?
Does generating an encryption key using the random number generator on one's computer present a security risk? If so how might that risk be mitigated, specifically when generating RSA key pairs in ...
9
votes
2answers
2k views
Cracking a linear congruential generator
I was recently listening to the security now podcast, and they mentioned in passing that the linear congrunential generator (LCG) is trivial to crack. I use the LCG in a first year stats computing ...
31
votes
2answers
3k views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
8
votes
1answer
998 views
Howto seed the PRNG in OpenSSL properly?
I am creating an application which runs on a mobile node with Ubuntu, which does not generate enough entropy bytes to the /dev/random, and does not always stay connected on the Internet to use typical ...
11
votes
2answers
601 views
Evaluating the entropy gathering in a PRNG
I'm reviewing the random number generator (expected to be of cryptographic quality) on an embedded device. My point of view here is the operating system and crypto library implementer. I'm ...
