Is it good to use a mouse movement as a 64-bit random seed for a Pseudorandom Generator like AES in Counter Mode?
Should I only need to get the X and Y coordinates of the mouse movement?
|show 3 more comments|
I suppose as far as entropy sources go, you could have chosen much, much worse. In fact a user properly moving his mouse while you collect a bunch of samples and hash them all together to obtain a seed is a pretty good random bit generator. Be conservative in your entropy estimates, for instance I would estimate no more than two bits of entropy per sample if you collect them intelligently (e.g. avoid continuous duplicates and keep a reasonably large sampling rate).
However obviously, a single mouse position is a terrible seed to use, since it doesn't even cover the whole 64-bit space. Your monitor is probably at best 1920x1080, which corresponds to about 2 million possible positions. WEAK.
But while this may be useful to keep in mind, it's probably best if you use an existing CSPRNG for your randomness needs, that way you don't bother the user, and you delegate security to someone else (which may be a good or a bad thing). You should always use the CSPRNG provided by your operating system as it is best placed to collect entropy, whether you like it or not. Under Windows, you can use
It might seem counterproductive to use another RNG to seed your own, but entropy collection isn't exactly a trivial little thing that you just plug into a program. It has to be carefully and constantly monitored and tracked to keep a good estimate of the available entropy and ensure you don't lose any of it. Sure, making your own ultrafast PRNG using AES in counter mode for your specific needs might be worth it, but you need to consider the limits of your own random generator.
There are a few questions here.