Supposing I have generated random data from CryptGenRandom (or similar PRNG), at what point does futzing with the values make it not-so-random that it's useless? Or is sufficiently random in enough to make it sufficiently random out?
Basically I'm looking at a key generation algorithm that generates an 8 digit 0-9 value from the output of CryptGenRandom. I realize the final output is limited anyway, but it's a protocol implementation to be 8 digits of 0-9.
Put another way, if I need to generate such values, what's the best approach?
EDIT: My first question was more in the general sense and the second was a clarification on what I actually need to accomplish. Suppose I have generated a 256 bit random value. I need to reduce the 256 bits to say 64 bits, but further constrain that to a numeric value (in this case 8 digits).
Removing half the bits has an effect on the usefulness of being cryptographically random (as it reduces the entropy? or is this a false assumption?). Reducing that further to just be numeric values surely has an effect on usefulness as well. Given that then,
Q1: In a general sense if I had to reduce the length of a random value, what methods should I avoid?
Q2: OR more specifically, am I being dumb about generating an 8 digit number?