# Do all numbers have all the same chances to be returned using a CSPRNG?

Given a range of numbers, e.g. [1, 2^256], does each number have the same chances to be picked by a CSPRNG, which are 1 in 2^256?

My concern is that truly random number generators do have this feature, but it's not always secure in cryptography (I presume), because numbers such as 741 in such a large range that is [1, 2^256] are not secure.

If that's true, do CSPRNG skip certain sub-ranges? Like, in our example [1, 2^32], because they're considered insecure? If that's also true, isn't this like beating the air, because now the attacker will know to skip these sub-ranges?

• Why would a random 256 bit value that happens to be 741 not be secure, compared to (say) 4787985879261692769246529503049509767911957330519830813409881797811302? If the adversary is guessing randomly, the latter is just as probable as the former... Commented Nov 19, 2022 at 21:01
• @poncho, but not as secure. Commented Nov 19, 2022 at 22:07
• Why "not as secure"? If you are worried about attacks that search for small values, why aren't you equally concerned about attacks that search for values around 4787985879261692769246529503049509767911957330519830813409881797811302? Both attacks succeed with equal likelihood, and hence neither is a greater threat than the other. Commented Nov 19, 2022 at 22:11
• @poncho, I'm not saying that large number is secure enough (I don't know how you generated), but if it was chosen randomly from [1, 2^256], then it's more secure in comparison with 741, because the latter comes from a range of numbers that is provably known to have been searched. Commented Nov 20, 2022 at 10:30
• Yes it’s a matter of chances. Why worry about something that will never happen? But feel free to make your CSPRNGs slower, biased and potentially introduce side channels that, unlike the stuff you’re worrying about, lead to actual attacks. The crypto community simply does not share your concerns, as you can see from other comments and answers, because they’re effectively impossible. Commented Mar 14, 2023 at 20:00