Is it safe to combine System.Random with cryptographically secure pseudo-random number generators?

Question

Have a look at the following codesample written in C#:

private static byte[] GetRandomBytes(int size)
{
    byte[] buff = new byte[size];
    // Create an array of crypto-secure random numbers
    using (RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider())
    {
        rng.GetBytes(buff);
    }

    // Gets a random byte from a non-crypto-secure RNG and xors each element with it
    // Alternatively, xor each element with a new random number
    int unsafeRand = (byte)_random.Next(0, 255);
    for (int i = 0; i < size; i++)
        buff[i] ^= unsafeRand;

    return buff;
}

Is it safe to combine the .NET cryptographically secure random number generators with an imperfect random number generator, for example via XOR?

Answer 1

Yes, if you XOR any values with a secure random numbers, you end up with secure random numbers.

You can easily see this by assuming the insecure random number is a constant instead. It only changes what the numbers are, it does not affect their relative probabilities.

Answer 2

Yes you can for the simple reason that XOR'ing a completely random stream with any value will still result in a random stream - although obviously very dependent for the randomness on the source stream.

There is however absolutely no point in doing so. XOR-ing a stream with a well seeded PRNG could be a good idea, but XOR'ing it with a single byte value (random or not) or a non-cryptographically secure stream doesn't bring you any additional security. Basically you would be wasting CPU cycles for no good reason at all.