# Correctly generating cryptographically secure pseudorandom numbers (in C)?

I am learning about cryptography, purely for my own interest. As part of that, I am implementing a simple toolset in C.

Naturally, I need to generate random numbers to create the pad, and they need to be cryptographically strong. I know about rand(), but from what I can tell it is not strong.

Is there a standard algorithm (or library) that I should be looking at to accomplish this?

-
So you want a stream cipher? –  CodesInChaos Apr 11 '12 at 19:39
I don't think so. I am looking for a CSPRNG that I can use in C. Just wondering if there is a standard for this. –  Tom Scrace Apr 11 '12 at 22:55
When you use a PRNG to generate a stream of bytes that you XOR with the plaintext to form ciphertext, that's a stream cipher (just like RC4). That is NOT a one-time pad. –  David Schwartz Apr 12 '12 at 9:22
Oh. Thanks David. Maybe I have misunderstood something here. So, you're saying that the defining feature of the one time pad is that the random bytes of the key are generated by some true source of randomness, as opposed to a PRNG? –  Tom Scrace Apr 12 '12 at 12:30
Essentially, yes. The difference between a one-time pad and a stream cipher is, essentially, that a one-time pad has a key that's the same size as the data encrypted while a stream cipher has a key size that is independent of the plaintext size. As soon as you hook an XOR engine up to a PRNG, it's not a one-time pad. A one-time pad has to hook the XOR engine to the key. –  David Schwartz Apr 13 '12 at 1:51