Say I want to create many random AES keys and have access to a secure source of random numbers SecRand
.
I see two extremes of how I could write a key factory.
Use the same random source for all keys:
KeyFactoryA {
private r = new SecRand()
makeKey() {
// create a key using r
}
}
Use a new source for every key:
KeyFactoryB {
makeKey() {
r = new SecRand()
// create a key using r
}
}
I remember from statistics lectures (different field, I know) that the aggregate stream of random bits used in B
would not necessarily be uniformly random; that is, B
would be statistically weak. Also, it requires a larger pool of entropy to initialize all the different r
.
A
, on the other hand, may create many keys from a small initial pool of entropy. That does not sound too good either.
Are there any security-related differences between the two options?