How to safely generate a random number
sockpuppet.org
How to safely generate a random number
1–10 of 62 posts
Re: How to safely generate a random number
#2Anyone want to give a total count of wrong assertions in this article?
Re: How to safely generate a random number
#3Anyone want to give a total count of wrong assertions in this article?
popcorn.gif
Re: How to safely generate a random number
#4I prefer the Munroe-Hatguy entropy collection method for pseudorandom number generation [1].
Re: How to safely generate a random number
#5I liked the part that said "urandom".
Re: How to safely generate a random number
#6So rather than using a function in the core library of the language that calls /dev/urandom, we should instead write our own wrapper around /dev/urandom? And this is supposed to be less prone to error?
Re: How to safely generate a random number
#7So rather than using a function in the core library of the language that calls /dev/urandom, we should instead write our own wrapper around /dev/urandom? And this is supposed to be less prone to error?
Where does this article say that?
Re: How to safely generate a random number
#8So rather than using a function in the core library of the language that calls /dev/urandom, we should instead write our own wrapper around /dev/urandom? And this is supposed to be less prone to error?
Where does this article say that?
The article lists several userspace libraries (OpenSSL, SecureRandom) and then says not to use them. I had the same question as weavejester.
Re: How to safely generate a random number
#9Earlier quoted context omitted.
Where does this article say that?
The article lists several userspace libraries (OpenSSL, SecureRandom) and then says not to use them. I had the same question as weavejester.
No. OpenSSL RAND_bytes and Java SecureRandom aren't simply libraries that "call /dev/urandom"; they are full-fledged CSPRNG designs, and must themselves avoid all the possible bugs a CSPRNG can have, in addition to their usual reliance on urandom not itself being vulnerable.
Re: How to safely generate a random number
#10So rather than using a function in the core library of the language that calls /dev/urandom, we should instead write our own wrapper around /dev/urandom? And this is supposed to be less prone to error?
If you know that's all your library does, as in the case of Golang crypto/rand, then use the library. But don't just assume that's all your library is doing.