361 reputation
8
bio website
location
age
visits member for 7 months
seen Aug 5 at 21:05

Aug
5
comment Is it safe to seed a random number generator from system time?
I've submitted patches to bc-csharp, which should fix bouncy castle SecureRandom in 1.8 onward. However, in java, I don't see any SecureRandom other than the aforementioned j2me version, which extends java.util.Random, without any secure seed. @otus you said the java version uses system entropy sources. Can you provide any kind of links?
Aug
4
comment Is it safe to seed a random number generator from system time?
Yes, bc-csharp only uses system time and ThreadedSeedGenerator. I'm no java expert, but how do you know what it uses in java? I don't see it in the java SecureRandom source code.
Aug
4
accepted Is it safe to seed a random number generator from system time?
Aug
4
comment Is it safe to seed a random number generator from system time?
Uggh. This is off-topic now for the question about system time, but it turns out, ThreadedSeedGenerator returns poor quality random - In all my tests, 50% compressible output was pretty typical and I've seen the output compress as much as 10:1. Which means a lot of patterns. And it fails the NIST sts tests. So in fact, regardless of the Ticks question, bouncy castle securerandom is unsafe to use. You might consider tinhatrandom.org as an alternative.
Jul
20
comment Can a EC private key be derived from a public key?
Bah to the downvoter. This answer uses a sound qualitative argument which is correct while simultaneously acknowledging not knowing the internals of ECC math.
Jul
19
awarded  Scholar
Jul
19
awarded  Supporter
Jul
19
accepted Can a EC private key be derived from a public key?
Jul
19
awarded  Nice Question
Jul
19
asked Can a EC private key be derived from a public key?
Jul
19
answered Can a EC private key be derived from a public key?
Jul
19
answered Generate Elliptic Curve Private Key from User Passphrase?
Jul
19
awarded  Nice Answer
Jul
18
awarded  Self-Learner
Jul
18
awarded  Editor
Jul
18
revised Is it safe to seed a random number generator from system time?
Answer was right about ticks being insufficient - corrected now about Bouncy Castle implementation details.
Jul
18
comment Is it safe to seed a random number generator from system time?
I am sorry - I just stepped through code for the nineteenth time, and I just discovered I was wrong. YES, it's bad to use time as seed to prng, NO that's not all bouncy castle does. In fact, BC SecureRandom has a static instance called Master, which is seeded from Ticks and ThreadedSeedGenerator. The "SetSeed" method is confusing because it only adds seed material from Ticks; does not reduce the strength of the already present seed.
Jul
18
awarded  Teacher
Jul
18
asked Is it safe to seed a random number generator from system time?
Jul
18
answered Is it safe to seed a random number generator from system time?