Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [random]

The generation of random or pseudorandom data, and the use of randomness in security protocols

Filter by
Sorted by
Tagged with
14 votes
4 answers
6k views

Security of a non-random password but that relies on information an attacker cannot possibly know

I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure. To give an example, let’s say that I generate my password by putting ...
hb20007's user avatar
  • 559
0 votes
0 answers
47 views

What is a secure way to create a random number in Typescript? [duplicate]

I want to create a function that returns a random number in a given range, what is a secure way of doing that?
a_duck's user avatar
  • 1
-1 votes
1 answer
109 views

Is encoding random with module insecure? [closed]

The ID library Nano ID claims that modulo based encoding (e.g. Base64) would lead to uneven distribution in the output: Uniformity. random % alphabet is a popular mistake to make when coding an ID ...
deamon's user avatar
  • 99
0 votes
2 answers
837 views

Can UUID v7 be treated as a unguessable, opaque identifier?

RFC4122bis specifies UUID v7, a version which contains 74 bits of randomness. Assuming I use a CSPRNG to generate the random bits: Are these UUIDs considered to be unguessable and are enough to ...
Jonas's user avatar
  • 105
0 votes
0 answers
27 views

Any idea on how this 36 character long string generated? [duplicate]

I have a personal id "U1KFhYtMqZhCYya6sy31PVLM8DlM5HLCkwy3", I have checked some hash functions but cannot make sure how this generated? Is this just random string generated with [a-zA-z0-9]?...
Slybot's user avatar
  • 101
1 vote
1 answer
185 views

Which algorithm does CryptGenRandom use on my laptop?

I have an Ideapad Gaming laptop by Lenovo, with an Intel(R) Core(TM) i5-10300H processor. On this laptop I have Windows 10 installed. To generate random numbers, I use the CryptGenRandom function. ...
Riemann's user avatar
  • 113
0 votes
1 answer
150 views

SecureRandom safety?

I need to randomly pick 10 numbers from 1 to 2000. It is very important that this rng cannot be predicted/hacked in any way. Would this be a safe/proper way to do it: int randomInt; SecureRandom ...
Cannon 190's user avatar
0 votes
2 answers
252 views

Is using weak random numbers for the initialization vector of AES just a theoretical issue?

I'm the maintainer of pypdf, a Python library for reading/manipulating PDF documents. I recently discovered that pypdf used random instead of secrets for ... Generating the initialization vector (IV) ...
Martin Thoma's user avatar
  • 3,932
0 votes
1 answer
99 views

Randomness of seeded cryptographically secure random number generator

If I generate a large true random number and I seed a CSPRNG with it, then can the output of this CSPRNG be used anywhere where there is a need for a true random number? For example, if Alice and Bob ...
rid's user avatar
  • 329
5 votes
5 answers
5k views

Randomly generated secrets: encoding the random bytes in base64 vs keeping them

Today this came to my attention. When generating random secrets for e.g. JWT (in node.js the most common way is using the crypto.randomBytes() method), I have noticed a lot of people save these tokens ...
Sam's user avatar
  • 169
1 vote
2 answers
131 views

exploiting the scenario and how to generate a secure reset password token

I am using the following line of code to create a reset password code sent to the user in her/his email. when scanned with brakeman to my ruby code, this line of code is catched and describes it as it ...
hanan's user avatar
  • 131
1 vote
3 answers
899 views

Is it possible to retrieve seed from a few random numbers?

Let's say I have generated 16 integers (between 0 and 128) using Python from random import seed, randint seed(1234) randoms = [randint(0, 128) for _ in range(0, 16)] If we have a rough knowledge of ...
leogarithm's user avatar
0 votes
1 answer
144 views

Pre-generate random numbers or generate it on the spot

We are developing a lottery platform, and we are discussing what the best way to implement it would be. As we have it right now, the system pre-generates, using a TRNG device, all the winning numbers ...
Greg's user avatar
  • 103
1 vote
2 answers
128 views

Is there any encryption method that uses TRNGs?

Can we create a true random generator whose entropy source is the loss of electrical signals that a binary architecture cannot detect? If we have a system that let's say could do this, could we be ...
Furqan Tariq's user avatar
1 vote
2 answers
200 views

Random identifier vs identifier plus HMAC

Suppose I have a resource that I want to be accessible only using a specific link. I could generate a link using a 256 bit random identifier, e.g. https://example.com/aMXtSQufIxntoMSnTQGdgMfs84VzM-...
Gordon Leigh's user avatar
1 vote
2 answers
263 views

How does /dev/random not leak future bytes from old ones

I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index. I know /dev/random should be ...
Xephobia's user avatar
1 vote
0 answers
280 views

How do in-memory unrandomizers (like in Cheat Engine) work?

Cheat Engine is a rather known memory editing and manipulation tool for Windows. It has this feature to screw up your randomness generation, how does it achieve it? My guess would be that it makes the ...
Sir Muffington's user avatar
0 votes
1 answer
126 views

Why GNU libc's salt alphabet for `crypt` is limited to ./0-9A-Za-z?

According to docs: To hash a new passphrase for storage, set salt to a string consisting of [a prefix plus] a sequence of randomly chosen characters ... and In all cases, the random characters ...
Anthony's user avatar
  • 103
1 vote
0 answers
132 views

Comparing HAVEGE and Jitter Entropy algorithms

How does the HAVEGE method (or rather, the specific adaption of it as used in haveged) for generating randomness from timing differ from that of the Jitter Entropy method? Is there any research ...
forest's user avatar
  • 66.8k
16 votes
5 answers
5k views

Pseudorandom vs. True Random

Proper security algorithms demand true random numbers. For instance, secret keys & initialization vectors should never not be true random. However, generating numbers using Java's Random library ...
mindoverflow's user avatar
0 votes
1 answer
162 views

Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?

Usually once you register in a website you need to visit a url like: https://example.com/user_activate/^random_string^ Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
Dimitrios Desyllas's user avatar
1 vote
1 answer
164 views

Should a user refill their 2FA when they login into a different account and back?

Some of our users on our website have two or more accounts they use to log in. With each device they log in a specific device ID is generated. This device ID is stored on the device itself and on the ...
Efekan's user avatar
  • 113
1 vote
1 answer
253 views

Can I evaluate the quality of my OS random numbers? [duplicate]

Is there a software or website that implements tests of randomness to check if my random numbers are of cryptography quality ?
boredaf's user avatar
  • 143
11 votes
2 answers
7k views

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

This question may be a little off-topic, but is Math.random the same as crypto.getRandomValues? (JavaScript) Here's an example: Math.random(); // 0.11918419514323941 self.crypto.getRandomValues(new ...
Parking Master's user avatar
1 vote
0 answers
519 views

How many random characters must an unguessable string contain?

I want to add a suffix to my URLs that makes them distinctive and therefore only findable by a person who knows that suffix. I considered using a UUID or hash, but these are usually very long. However,...
F.M.F.'s user avatar
  • 127
1 vote
1 answer
332 views

Does combining a non-cryptographically secure string with a cryptographically secure string result in a cryptographically secure string?

I'm using php, but the general question applies to any confirmed cryptographically secure pseudo-random string concatenated with a non-cryptographically secure string. I know random_bytes generates a ...
TCooper's user avatar
  • 366
10 votes
6 answers
4k views

Can iterated hashes be used to create cryptographically secure random data from strong random seed?

I was wondering if generation of sequential hashes from random seed can be considered "random enough" to be used in cryptographic operations? By sequential hashes I mean the following: First ...
The amateur programmer's user avatar
0 votes
1 answer
188 views

Verifying public key visually

Verifying a string of long numbers is hard (think of cert public key). I remember there is a tool to visualize this randomness into a "randomness graph" but I cannot recall what is the graph ...
tkokasih's user avatar
  • 103
2 votes
3 answers
1k views

Is a simple random+hmac session cookie breakable?

I make session cookies of form session_id+'|'+hmac_sha256(session_id, static_secret) where session_id = random_string(16 bytes) made with a PRNG (not a CSPRNG!) seeded on the server's timestamp at ...
capr's user avatar
  • 123
1 vote
1 answer
456 views

Randomness of hash of (password + suffix)

Suppose I have a password, say "thisIsThePassword". Then I have MD5 hashes of that password followed by an increasing numeric suffix: MD5("thisIsThePassword1") = ...
reed's user avatar
  • 15.8k
0 votes
3 answers
679 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
S. Imp's user avatar
  • 216
1 vote
2 answers
241 views

Is it bad to reveal random bytes from a system?

Let's say you cat /dev/random or /dev/urandom all day from boot to system shutdown, either redirecting the output to a file, or just catting it (in a terminal, or whatever) doesn't matter. Is this ...
William Martens's user avatar
3 votes
1 answer
2k views

Is Python's `secrets` module using the same code as the `random` module?

The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually ...
random's user avatar
  • 31
0 votes
1 answer
248 views

Are weak entropy sources worth it?

I maintain an operating system that can be deployed to embedded devices with highly diverse capabilities. One of the aspects of porting the OS to a device is declaring the available entropy sources (...
Gilles 'SO- stop being evil''s user avatar
2 votes
5 answers
1k views

Attacks Relying on Poor Entropy

I'm creating a quantum random number generator as part of my thesis. As part of the research phase, I'm trying to substantiate my aspertion that encryption is significantly weakened if a computer ...
ScottishTapWater's user avatar
5 votes
1 answer
283 views

Security Implications of Caching Randomness

Is it a bad idea to cache randomness in the general case? My feeling is yes, but I'm having a hard time articulating why. Scenario: A programming language of your choice (e.g. node) uses a native call ...
vincent's user avatar
  • 171
-1 votes
1 answer
395 views

What is "environmental noise"?

I'm looking at way to generate random numbers for cryptographic purposes. More specifically, I looked at the Linux /dev/urandom function, which is considered a real random number generator. There are ...
Sam The Sid's user avatar
0 votes
1 answer
678 views

So I just got a voicemail from a random person, where it says 3 random numbers (for example 354) and then "goodbye" [closed]

So basically, i was just playing games as always, and I get a voicemail. It reads-"396 (random numbers just incase the numbers are sensitive information), goodbye" It sounds automated but i'...
Kevin Phelan's user avatar
1 vote
2 answers
314 views

How to select a random node when nodes are untrusted in a distributed network?

Assume in a distributed network, where the nodes are not trusted and are identified by their public keys, we intend to select one of them in a random process. In such a situation, all of the nodes ...
Questioner's user avatar
  • 1,317
0 votes
0 answers
392 views

Weird GET request on internet facing Nginx [duplicate]

I spun up an internet facing nginx server in AWS and the logs started showing weird get requests with a search engine's spider as user agent. 172.31.43.193 - - [19/Aug/2020:20:09:19 +0000] "GET /...
Shabin Muhammed's user avatar
0 votes
1 answer
742 views

Security of PHP's str_shuffle()

I'm doing some research on PHP's str_shuffle function, I already asked this question multiply times on StackOverflow but got no answer https://stackoverflow.com/questions/61968859/is-it-possible-to-...
user239146's user avatar
8 votes
2 answers
351 views

Randomly selected words converted into sentence. Did I lose passphrase strength or gain it?

I got 5 dice and opened EFF's wordlist, and generated a random five-word passphrase (all letters small with spaces, no punctuation) for my PC. The words were making up a meaningful scene in my mind, ...
user's user avatar
  • 275
5 votes
2 answers
4k views

Is it cryptographically safe to use veracrypt in a virtualbox virtual machine?

Does virtualbox provide enough entropy (random numbers) for the veracrypt program on the virtual machine? Is it cryptographically safe to use veracrypt inside a virtualbox in a windows 10 guest?
chanaccll's user avatar
0 votes
0 answers
477 views

Random URLs to hide assets [duplicate]

Say I own a domain name www.example.com and I'd like to host some resources on it, but being reasonably hidden from the public. Since a 256 bits has a sufficiently large entropy to prevent an ...
Arthur Attout's user avatar
3 votes
1 answer
251 views

Randomly generating invoice IDs

I'm in the process of setting up a local (i.e. offline and very limited) business, and I'm thinking of generating invoice IDs randomly to avoid the clients knowing that they're customer number #...
Hashim Aziz's user avatar
2 votes
1 answer
531 views

Did PHP's rand() get better?

I know that PHP used the system implementation for its rand() function, which is usually a weak LCG or LFSR implementation. Did this change? In case it still does, I am using Fedora 32. PHP states in ...
dmuensterer's user avatar
  • 1,184
0 votes
3 answers
284 views

Is a random number secure (enough) for card numbers and pins?

I've been given the task of generating some gift tokens which comprise a serial number and a pin number, analagous to a pre-paid credit card. The serial and pin will be printed on a card, with the pin ...
Greg B's user avatar
  • 181
0 votes
0 answers
324 views

Generating trusted random numbers for a group?

Alice and Bob need to share some cryptographically-secure random numbers. Alice does not trust Bob, and Bob does not trust Alice. Clearly, if Alice generates some numbers, and hands them to Bob, Bob ...
Him's user avatar
  • 130
0 votes
1 answer
215 views

What vulnerabilities would this type of "password manager" have?

When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
user avatar
1 vote
1 answer
607 views

Does OAuth2 state parameter need to be cryptographically secure?

In OAuth2, as part of the authorization request, we generate a random string and pass it with the state parameter, so that when we get the response, we can ascertain that the response is a result of ...
Gigi's user avatar
  • 1,320

1
2 3 4 5
8