Hot answers tagged

461 votes
Accepted

Why is Math.random() not designed to be cryptographically secure?

I was one of the implementers of JScript and on the ECMA committee in the mid to late 1990s, so I can provide some historical perspective here. The JavaScript Math.random() function is designed to ...
Eric Lippert's user avatar
  • 4,446
120 votes

Why is Math.random() not designed to be cryptographically secure?

Because there actually is a cryptographically secure alternative to Math.random(): window.crypto.getRandomValues(typedArray) This allows the developer to use the right tool for the job. If you want ...
Philipp's user avatar
  • 49.4k
119 votes

Expert quote on entropy for uncrackable password

There's a quote for you in this crypto.SE answer, by Bruce Schneier in Applied Cryptography (1996), pp. 157–8. You can also find Bruce Schneier citing himself in his blog (2009), if you want an ...
A. Hersean's user avatar
  • 10.6k
76 votes
Accepted

What makes Random Number Generators so fragile?

Hardware vs software RNGs The first thing you mention is a hardware noise source. High-precision measurement of some metastable phenomenon is enough to generate unpredictable data. This can be done ...
forest's user avatar
  • 66.6k
74 votes

Why is Math.random() not designed to be cryptographically secure?

JavaScript (JS) was invented in 1995. Potentially illegal: cryptography was still under tight export control in 1995, so a good CSPRNG might not even have been legal to distribute in a browser. ...
Luc's user avatar
  • 32.9k
62 votes
Accepted

Randomly generated secrets: encoding the random bytes in base64 vs keeping them

It doesn't matter. A number doesn't change because you change the encoding of it. 1012 and 510 is the same number, and contain the same amount of information. The reason we use base64 is that it is ...
vidarlo's user avatar
  • 16k
44 votes
Accepted

Pseudorandom vs. True Random

There is a (common) misconception in this question that there is such a thing as “true” randomness and that this matters for security. In fact, whether “true” randomness exists is a philosophical ...
Gilles 'SO- stop being evil''s user avatar
40 votes
Accepted

Predicting Math.random() numbers?

Indeed, Math.random() is not cryptographically secure. Definition of Math.random() The definition of Math.random() in the ES6 specification left a lot of freedom about the implementation of the ...
Benoit Esnard's user avatar
35 votes
Accepted

Is randomly generating passwords from an assortment of dictionary words cryptographically secure?

First, there is no such concept as a cryptographically secure password. The aim of a password is to be hard to guess for an attacker and how hard it should be to guess depends on how the password is ...
Steffen Ullrich's user avatar
35 votes
Accepted

Can iterated hashes be used to create cryptographically secure random data from strong random seed?

No this is cryptographically completely insecure This construction violates a very important property of cryptographically secure PRNGs, namely that knowing one part of the PRNG's output does not help ...
nobody's user avatar
  • 11.5k
29 votes
Accepted

Is "always use /dev/urandom" still good advice in an age of containers and isolation?

I wrote an answer which describes in detail how getrandom() blocks waiting for initial entropy. However, I think that he slightly oversells urandom by saying that "the only instant where /dev/...
forest's user avatar
  • 66.6k
28 votes
Accepted

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

See MDN: Crypto.getRandomValues(), where it reads: The Crypto.getRandomValues() method lets you get cryptographically strong random values. (emphasis mine) In contrast, see MDN: Math.random(), where ...
mti2935's user avatar
  • 23.4k
27 votes

Predicting Math.random() numbers?

You can attack these using the Z3 theorem prover. I've implemented such an attack in Python in order to predict values in a lottery simulator. As mentioned previously, XorShift128+ is used in most ...
douggard's user avatar
  • 367
27 votes
Accepted

Expert quote on entropy for uncrackable password

Let's take a different crack from a monetary perspective instead of a physics perspective. Skylar Nagao at Peerio stated that: In a 2014 research paper on password memorability, security ...
Cody P's user avatar
  • 1,148
26 votes
Accepted

Unix command to generate cryptographically secure random string

No, it's not entirely secure. Let's look at each of the commands: dd if=/dev/urandom bs=256 count=1 2> /dev/null This will read a single 256 byte block from /dev/urandom, a cryptographically ...
forest's user avatar
  • 66.6k
25 votes
Accepted

Is a concatenation of random numbers better than a single random number?

So is the concatenated random number better than a single random number? If the random generator really produces random data then it will not matter. ... it would be harder to predict the next ...
Steffen Ullrich's user avatar
21 votes

Is randomly generating passwords from an assortment of dictionary words cryptographically secure?

It seems to me that your calculations are correct. Even though, please consider the following weaknesses: An attacker can and will sign up for your service with multiple (a LOT of) accounts. From ...
MiaoHatola's user avatar
  • 2,314
20 votes

Why is Math.random() not designed to be cryptographically secure?

This is too long for a comment. I believe there is a flawed premise in your question: on modern (and even not so modern) computers, it would be trivial to output hundreds of megabytes per second ...
Jared Smith's user avatar
  • 1,988
17 votes

What makes Random Number Generators so fragile?

Historically, hardware RNGs suitable for cryptography weren't commonly available on the PC: for example, according to this question AMD only added support a few years ago, so even today a software ...
Harry Johnston's user avatar
17 votes

Randomly generated secrets: encoding the random bytes in base64 vs keeping them

As you say, base64 uses 4/3 times as many symbols to represent the same value. Each symbol of base64 encodes 6 bits, instead of 8. That's a ratio of 3/4. (4/3) * (3/4) = 1. The information content is ...
hobbs's user avatar
  • 647
16 votes
Accepted

Cryptographically secure number generator for node.js

You are correct that Math.random() is not secure. If you want a CSPRNG in Node.js, crypto.randomBytes() is what you're looking for.
Anders's user avatar
  • 65.5k
16 votes

Why is Math.random() not designed to be cryptographically secure?

The larger reason is that there is an alternative to Math.random(): see Philipp's answer. So whoever needs strong crypto may have it, and those who don't can save time and (battery) power. But ...
LSerni's user avatar
  • 22.8k
15 votes

Why are randomly generated passwords often hexadecimal?

(Do you have evidence that random passwords are usually hex?) Here are some possible reasons why you frequently find hexadecimal passwords: The passwords you see might be already hashed. Since hash ...
Arminius's user avatar
  • 44.7k
14 votes
Accepted

What's eating my entropy? Or what does entropy_avail really show?

First, the claim that "/proc/sys/kernel/random/entropy_avail simply gives you the number of bits that can currently be read from /dev/random" is false. The entropy_avail field reads the input_pool....
Lekensteyn's user avatar
  • 6,088
14 votes

Why is Math.random() not designed to be cryptographically secure?

Random numbers and cryptorandom bits are completely different animals. They are not even used for the same purpose. If you want a random number evenly distributed between 0 and 42, then you want an ...
Rob's user avatar
  • 649
14 votes

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

Your friend is correct; always use Crypto.getRandomValues instead of Math.random for anything related to security. Math.random is designed for statistical simulations; and the numbers it produces ...
John Deters's user avatar
  • 34.2k
13 votes
Accepted

Is there a loss of entropy by hashing an N-bit random key to produce an N-bit hash?

Hashing is a deterministic process which means that it can never increase the randomness. But of course it can decrease the randomness: if you hash a 200 bit random value with some hash algorithms ...
Steffen Ullrich's user avatar
12 votes

What makes Random Number Generators so fragile?

Because they are difficult to test While it's easy to test that a random number generator produces output with the right format, determining whether it's statistically random is much more involved ...
paj28's user avatar
  • 33.4k
11 votes
Accepted

Ways to generate symmetric and asymmetric keys

You seem to ask for a comparative study on the PRNG (pseudo-random number generators) used by default by OpenSSL and the Linux kernel. This could most probably fill a volume full of mathematical ...
WhiteWinterWolf's user avatar
11 votes

Is "always use /dev/urandom" still good advice in an age of containers and isolation?

There are three states the system can be in: Hasn't collected enough entropy to safely initialize a CPRNG. Has collected enough entropy to safely initialize a CPRNG, and: 2a. Has given out more ...
Nathaniel J. Smith's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible