This question already has an answer here:
- Why shouldn't we roll our own? 11 answers
Is there a good/better/best way to generate a one time pad? I would like to only utilize about 40 characters (a-z, 0-9, .,!-).
What I have come up with is perhaps not the BEST way, but seems to fill my needs. It essentially works this way:
1) Generate a random seed using the MS RNGCryptoServiceProvider service
2) Populate an array with a base of all of the characters I use
3) Perform a "switch" based on the random number of the 1st character and the random number (base 40) character in the array after this character
4) Pause a random amount of time determined by yet another random seed call (1-5ms)
5) Get a new seed
6) Perform a "switch" based on the random number of the 2nd character and the random number (base 40) character in the array after this character
7) Continue until all characters are swapped, generating a new random seed at every iteration, switch, etc.
8) Repeat the process 5,000 (adjustable) times
9) Repeat steps 3-8 10,000 (adjustable) times
10) Write the line to a secure location (either on-screen, encrypted thumb drive, etc.)
11) Using the previous array-based line, repeat steps 3-8 for however many times/lines I want.
This has the residency of reusing old/new seeding (i.e. seeding upon itself) for the switches. I know there are holes in this, but for the actual generation aspect, I figure I can define how many loops per cycle can be run (if a user want to go crazy, they can do 100-millions of switches per line, and can adjust the starting point to between 100-millions). More seems better, but to what end is up to the user.
I will put this out there - my machine runs extremely fast with the Intel CPRNG on the chip. I KNOW this is/can be a security hazard, but I am wondering, just for the generation algorithm, does this seem to be a good way to generate OTP pads? As there is a whole host of other security problems that can be either added to the list or removed judiciously, I am just asking - how much do you need to make an OTP pad, and would the above work?
Thanks in advance, and I will correct anything anyone has questions about.