The paper Cryptanalysis of the Random Number Generator of the Windows Operating System describes some problematic aspects of the Windows CSPRNG. However the paper was written in 2007, and looked at the version of the generator present in Windows 2000. Are the problems described still issues in more recent Windows (7 or 8 for example)?

1 Answer 1


From the Wikipedia page:

A 2007 paper from Hebrew University suggested security problems in the Windows 2000 implementation of CryptGenRandom (assuming the attacker has control of the machine). Microsoft later acknowledged that the same problems exist in Windows XP, but not in Vista. Microsoft released a fix for the bug with Windows XP Service Pack 3 in mid-2008.

So the answer would be: no, the described issues are no longer present in recent versions of Windows.

To be fair, the said issues were not critically serious to begin with. They were more indicative of suboptimal design; they could be turned into actual attacks only in situations where the attacker already has extensive power (he can read the victim's memory space...). Apparently, Microsoft tried to argue with the article authors (so it says there) but finally backed down, when they realized that "fixing" the PRNG was cheaper than arguing about it, and the admit-and-patch process could even be given a positive spin from a Public Relations point of view.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .