1

I have an Ideapad Gaming laptop by Lenovo, with an Intel(R) Core(TM) i5-10300H processor. On this laptop I have Windows 10 installed. To generate random numbers, I use the CryptGenRandom function. However, I found out that this function has been updated through the years. For example, in the past the algorithm used RC4 (see Wikipedia), but that algorithm contained a bug. The algorithm has been revised since then, but it has never been published. Does it still use an RC4 algorithm, or has it another name now? Is it the same on my laptop as on all other modern Windows laptops?

Improve this question

1 Answer 1

Reset to default
1

First of all, this API is deprecated, so this is not used on your modern laptop except for if you have legacy software, the manual for the modern API is here. It is 100% up to the programs that use the API on what cipher modes or the exact stream they pull out of, so I can't answer what the modern API uses.

To answer the question about the deprecated API, it depends on what version of Windows the API is on.

In Windows Vista with Service Pack 1 (SP1) and later, an implementation of the AES counter-mode based PRNG specified in NIST Special Publication 800-90 is used. In Windows Vista, Windows Storage Server 2003, and Windows XP, the PRNG specified in Federal Information Processing Standard (FIPS) 186-2 is used.

Improve this answer
5
  • ‘so this is not used on your modern laptop except for if you have legacy software’: the Python secrets module and Python random module and os.urandom use this algorithm to generate random numbers. So i think that this API is used a lot by popular modern software.
    – Riemann
    Jul 14 at 7:02
  • I recently found this out, see this question: crypto.stackexchange.com/questions/107190/…
    – Riemann
    Jul 14 at 7:06
  • @Riemann My point wasn't to say that modern software couldn't use it per se, but that the Microsoft developers intend for all modern software to go to their new shiny API.
    – user287834
    Jul 17 at 0:41
  • I searched the NIST special publication and it doesn’t mention RC4. Now the question remains whether the Secure Key Technology is used in my case. I think that this is not explained in the NIST publication, since it only contains recommendations.
    – Riemann
    Jul 17 at 16:10
  • 1
    I think I will just ask that in a new question.
    – Riemann
    Jul 18 at 7:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .