# Is script execution time a decent source of pseudorandom number generation?

This is for a PHP script for password generation. Naturally there are other things being calculated before the password is generated. But I figure the time it takes for the script to initialize and queue would make it decently pseudorandom.

Has there been studies on script execution time as a source of pseurandom number generation?
If not, any tips on how to conduct cryptanalysis on this?

-
There might be a certain amount of unpredictability in this (presuming the adversary doesn't have full access to the parent system and you don't do this in the context of responding to the request), but you need a high resolution timer (not just microtime) and more than a single timing. –  Henrick Hellström Feb 21 at 9:45
Why do you want to try dangerous things like that, instead of simply using mcrypt_create_iv(size, MCRYPT_DEV_URANDOM)? –  CodesInChaos Feb 21 at 13:01
This may be of interest to you. Four links about algorithms which generate entropy from CPU times. Have not read them yet, but they look promising: [1] issihosts.com/haveged [2] dankaminsky.com/2012/08/15/dakarand [3] jytter.blogspot.se [4] chronox.de –  izaera Mar 1 at 7:58

AFAIK, there are papers that show, for example, that process times are not so random as they may seem. This is in the context of operating systems gathering entropy for devices like /dev/random. I've read this in many places but I can't provide any reference (if someone could it would be great ;-)).

Having said that, if you have other sources of entropy, script time could be an additional input, of course. Some considerations that come to my mind are:

• Take care with the resolution of your time source: if the maximum resolution is minutes, it will probably return always 0.

• Run some tests to see what results you get and how they are distributed. A usual distribution could be that 1 is returned 20% of the time, 2 30%, 3 30%, 4 20%, for example.

Depending on how you plan to use these "random values" these considerations may alter the results one way or another.

My advice is that you use a decent entropy generation algorithm instead of trying to invent your own. You can start your quest, for instance, here:

https://en.wikipedia.org/wiki/Fortuna_(PRNG)

See the reference links for more algorithms.

-
I would not use an entropy generation algorithm at all. Just leave it to the OS. –  CodesInChaos Feb 21 at 13:02
+1 for CodesInChaos comment ;-D. It's always better to use known libraries, but I was just supposing that, for some reason, he has no entropy source available. Otherwise, why not using it, Ryan? –  izaera Feb 21 at 17:38
@izaera actually I'm using one byte of entropy from random.org in addition to other sources, which are all hashed to generate a password. Rest assured, it's not the only source of entropy (openssl in php is used as well), I was just curious whether or not it alone is decent. –  user3201068 Feb 21 at 22:15
While Fortuna is a cryptographically strong pseudorandom number generator, it doesn't 'generate' any entropy. It has an algorithm for distributing callers' entropy among pools, but it does not itself provide any entropy (except its flat file, but even that's not there the first time it starts). –  Brock Hansen Feb 28 at 0:48
Be careful because random.org expressly discourages its use for cryptographic purposes. Regarding script execution time it can, IMO, be an imperfect entropy source. With imperfect I mean that only a few bits may be extracted and also that how many may depend on the underlying architecture. The execution time of an algorithm per se is not random. It's the time slicing (threading) and interrupts that makes it random. But threading and interrupts depending on the situation may not provide enough entropy. That's why I suggested mixing it with Fortuna, Sparrow, etc. –  izaera Feb 28 at 7:21