Questions tagged [pseudo-random-number-generator]
A pseudorandom number generator (PRNG) is an algorithm for generating a sequence of numbers whose properties approximate the properties of sequences of random numbers.
31
questions
16
votes
5
answers
5k
views
Pseudorandom vs. True Random
Proper security algorithms demand true random numbers. For instance, secret keys & initialization vectors should never not be true random.
However, generating numbers using Java's Random library ...
- 287
10
votes
4
answers
4k
views
Passphrase generator using German word list and Python's "secrets.choice()" to select from the list. Are those strong passphrases?
There are a numerous passprase generators out there, but all (I have found) use English words to build the passphrase. I'd rather use German words, so I wrote a generator in Python that selects words ...
- 209
5
votes
2
answers
2k
views
What exactly is the Randstorm vulnerability?
I've read the article from Unciphered about it, multiple times, and still fail to understand it.
It basically says that wallets generated by the BitcoinJS front-end library from 2011 to 2015 are ...
- 51
4
votes
2
answers
282
views
Is Java's probablePrime used in production?
Prime numbers are core in security.
I saw this question about Java's probablePrime
and was wondering if that API/approach is indeed used for real production-ready security code or other approaches are ...
- 193
4
votes
1
answer
776
views
Does rngd -r /path/to/file inject into /dev/urandom in addition to /dev/random?
I'm new to the /dev/random and /dev/urandom pipes in general and have an application calling from /dev/urandom which I'm attempting to inject entropy into. I'd prefer not to change the source for ...
- 143
3
votes
2
answers
473
views
Is this method of 32 char hash generation secure enough for online-based attacks?
A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I've come here to see if smarter people than I (us?) can shed some ...
- 131
3
votes
1
answer
278
views
Randomly generating invoice IDs
I'm in the process of setting up a local (i.e. offline and very limited) business, and I'm thinking of generating invoice IDs randomly to avoid the clients knowing that they're customer number #...
- 979
3
votes
1
answer
2k
views
Is Python's `secrets` module using the same code as the `random` module?
The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually ...
- 31
2
votes
1
answer
574
views
Did PHP's rand() get better?
I know that PHP used the system implementation for its rand() function, which is usually a weak LCG or LFSR implementation. Did this change?
In case it still does, I am using Fedora 32.
PHP states in ...
- 1,184
2
votes
1
answer
166
views
Is getting 1-2 outputs from a CSPRNG to seed another CSPRNG less entropy than getting say 5000 outputs from a CSPRNG and using that to seed?
This question builds off of this question.
I want to create more entropy from a viable entropy source to seed another CSPRNG.
If I use
window.crypto.getRandomValues(newUint8Array(1))
To seed a ...
user215466
1
vote
3
answers
1k
views
Is it possible to retrieve seed from a few random numbers?
Let's say I have generated 16 integers (between 0 and 128) using Python
from random import seed, randint
seed(1234)
randoms = [randint(0, 128) for _ in range(0, 16)]
If we have a rough knowledge of ...
- 13
1
vote
1
answer
355
views
Does combining a non-cryptographically secure string with a cryptographically secure string result in a cryptographically secure string?
I'm using php, but the general question applies to any confirmed cryptographically secure pseudo-random string concatenated with a non-cryptographically secure string.
I know random_bytes generates a ...
- 366
1
vote
2
answers
352
views
If I seed a CSPRNG with a truly random number and call the output, does this make the number more, less or equally "random"?
If I have a JavaScript CSPRNG such as isaac.random(), and I seed it using a truly random number T as such: isaac.seed(T), does this make the result of the CSPRNG more, less, or equally random?
I ...
- 81
1
vote
1
answer
187
views
Does a TPM replace the default device's security, or add to it?
Does a TPM replace the default device's security, or add to it?
I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing.
If we ...
- 177
1
vote
1
answer
504
views
What is the correct way to seed CSPRNG functions?
When using CSPRNG (crypto secure pseudo random number generation) functions seeding is an important step. So what is the best way to seed a random number function?
- 1,669
1
vote
2
answers
323
views
Why are cryptographically secure random number generators required for shared keys?
As I understand, key exchange for secure communications like TLS has a client take a server's public key, generate a random AES key and send that as a shared key for further communication. The key is ...
- 135
1
vote
2
answers
252
views
Is it bad to reveal random bytes from a system?
Let's say you cat /dev/random or /dev/urandom all day from boot to system shutdown, either redirecting the output to a file, or just catting it (in a terminal, or whatever) doesn't matter. Is this ...
- 177
1
vote
1
answer
156
views
What affect does modulus have on CSPRNG outputs?
I work in security and I've seen modulus (modulo) used in many encoding and crypto algorithms. However, today, a friend of mine mentioned that using modulo like this:
unsigned long int result = ...
- 1,229
1
vote
1
answer
426
views
How can I validate that a PRNG's output is insecure and predictable?
Say I talk to a developer who is using some output of a Pseudo-random number generator in order to do some security task. I know based upon common knowledge that only Cryptographically Secure Pseudo ...
- 1,229
1
vote
0
answers
22
views
Is it ok to use NativePRNGNonBlocking SecureRandom for making jwt? [duplicate]
I'm developing jwt auth feature with Spring WebFlux. And, I found the blocking calls in jjwt library by using BlockHound.
The reason of blocking calls was SecureRandom use /dev/random to make random ...
- 11
1
vote
2
answers
297
views
How does /dev/random not leak future bytes from old ones
I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index.
I know /dev/random should be ...
- 13
0
votes
1
answer
980
views
Why can't you use True Random Number Generator (TRNG) to generate key stream in Stream Ciphers?
I read in the book that you cannot use True Random Number Generator (TRNG) to generate key stream in Stream Ciphers:
We
need some type of random number generator to derive the key stream. First, we ...
- 113
0
votes
2
answers
299
views
Is using weak random numbers for the initialization vector of AES just a theoretical issue?
I'm the maintainer of pypdf, a Python library for reading/manipulating PDF documents. I recently discovered that pypdf used random instead of secrets for ...
Generating the initialization vector (IV) ...
- 3,942
0
votes
1
answer
214
views
SymmetricKey vs SecRandomCopyBytes
Can SymmetricKey be used as substitute for SecRandomCopyBytes? I found this code snippet in WWDC19 video
var key = Array(repeating: 0, count: 32)
let err = SecRandomCopyBytes(kSecRandomDefault, ...
0
votes
1
answer
400
views
Generating tokens via PRNG and Hashing
We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it
Step 1: Generate a random number using a good a CSPRNG ...
0
votes
0
answers
43
views
Does the permutation cycle of a PRNG change completely with different seeds? [migrated]
Apologies if this seems like a trivial question.
I've been learning PRNG and cryptographic basics and I don't think I've found an answer to this question (At least that I understand).
My understanding ...
- 1
0
votes
1
answer
167
views
SecureRandom safety?
I need to randomly pick 10 numbers from 1 to 2000. It is very important that this rng cannot be predicted/hacked in any way. Would this be a safe/proper way to do it:
int randomInt;
SecureRandom ...
0
votes
1
answer
109
views
Randomness of seeded cryptographically secure random number generator
If I generate a large true random number and I seed a CSPRNG with it, then can the output of this CSPRNG be used anywhere where there is a need for a true random number?
For example, if Alice and Bob ...
- 339
-1
votes
1
answer
417
views
What is "environmental noise"?
I'm looking at way to generate random numbers for cryptographic purposes. More specifically, I looked at the Linux /dev/urandom function, which is considered a real random number generator. There are ...
-1
votes
1
answer
133
views
owasp zap api with generate param [closed]
my api is:
localhost/api/aut/1111111111111111
I wanted a script that generate a code of 16 numeric and test possibility the result 200 or 404
- 103
-4
votes
2
answers
180
views
Is there a way to programatically generate new hash functions that are secure?
Is it possible to programmatically generate different hash functions? Of course, it is. We can simply tweak the numerical parameters of the hash function. But is there a known way to generate secure ...
- 101