0

We are developing a lottery platform, and we are discussing what the best way to implement it would be.

As we have it right now, the system pre-generates, using a TRNG device, all the winning numbers for the day (about 400) and store it encrypted in a database table. Then, at the specific time that the draw is to be executed, the platform chooses, sequentially, the winning number that was pre-generated and presents it to the clients that are awaiting for the draws.

Some of us are not too sure of this approach, and worry that whoever has access to the server where the database is hosted will be able to see what the winning draws for the day are. They believe that generating the random number on the spot is the only way to go, but I wonder if pre-generating them and encrypting the numbers is secure enough.

It is my belief, that if somebody has access to our server we will have bigger problems than just that, as we have other APIs running there that are of crucial importance to the operation of our business, and that we should focus on hardening the server against intruders.

I would like to know what the best approach would be in this situation.

Improve this question
2
  • 1
    Why not make your attack surface as small as possible? What's the downside of generating the winning numbers on the spot?
    – mti2935
    Sep 22, 2022 at 15:39
  • @mti2935, truth be told, it's because this solution is already implemented and if we do not have to change it then that's work and time that we can dedicate to something else.
    – Greg
    Sep 22, 2022 at 16:23

1 Answer 1

Reset to default
3

It is my belief, that if somebody has access to our server we will have bigger problems

They wouldn't necessarily need access to the server itself - it may also be sufficient to have access to a backup of the data (depending on how often you back it up). And there are lots of vulnerabilities that can allow an attacker to read information but not to modify it or execute code - which could be enough for them to get the winning numbers.

It also sounds like it would make it easier for a malicious insider to cheat in the lottery - because they only need to be able to obtain some information from the server (or backups), and then buy a ticket with those numbers. If you're generating them on the fly, they would need to find a way to tamper with (or replace) the TRNG device, or change the process used to generate and store those numbers so that it returns a the numbers they want - which is probably more difficult and would leave more traces.

The longer the period between generating and using the winning numbers, the greater the chance that they are compromised. So what's the benefit to generating them before they're needed? The main thing I can think of is that if your TRNG breaks then you might still be able to run some lotteries that day (assuming you've already generated the numbers) - but perhaps you can think of other benefits? Do they outweigh the increased risks of that approach?

Improve this answer
4
  • That is an excellent take. Most of what you said I already thought about, but I worry more that somebody could reverse-engineer the API and substitute it with his own at which point it won't matter if the numbers are pre-generated because the whole system is compromised. Changing the API for another that allows somebody to generate their own numbers is much worse than allowing somebody with bad intentions to access the server and read, it's a chicken and the egg sort of problem in my opinion
    – Greg
    Sep 22, 2022 at 16:39
  • The members of the team who implemented the current solution understood that from a performance point of view it would be better to pre-generate the numbers as it would be much faster to request hundreds of numbers in one call and store them than doing 400 calls during the day
    – Greg
    Sep 22, 2022 at 16:41
  • If someone can change the API you've lost either way. But it's a much noisier and more intrusive thing to do, which means that it should be easier for your monitoring to detect that it's happened. Someone reading a couple of rows from a database (or a backup of a database) is rather harder to detect. Generating on the fly won't protect you against every attack but it should protect you against more attacks.
    – Gh0stFish
    Sep 22, 2022 at 17:16
  • @Greg and if they're suggesting an approach that you think is less secure for "performance" reasons, ask them to benchmark and quantify them. If generating each number take a minute, then that's a legitimate concern. If it takes 50ms then it's probably not.
    – Gh0stFish
    Sep 22, 2022 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .