The C++ rand() function is an Linear Congruential Generator (LCG) PRNG. my questions are:
- Why was this algorithm chosen?
- What are the pros and cons?
- Is it good for cryptography?
$\begingroup$
$\endgroup$
-
3$\begingroup$ Note that the C++ standard doesn't mandate an LCG to be used (and thus the decision was made by the c standard library implementers). $\endgroup$ – SEJPM♦ May 8 '19 at 19:10
-
4$\begingroup$ rand() is seeded by srand, which takes an unsigned as the sole seed (which determines the sequence of rand() outputs) - you can't come up with a cryptographically secure RNG with a seed that small $\endgroup$ – poncho May 8 '19 at 19:35
$\begingroup$
$\endgroup$
The C++ rand() function (actually C function) is not (intended | designed | standarized) for Cryptographic purposes.
- Why was this algorithm chosen?
As SEJPM noted in the comments, the rand function comes from C and C++ has no upper restriction for the implementation.
- What are the pros and cons?
- Is it good for cryptography?
Long story short answer; don't use it for cryptography. For cryptographic purposes use /dev/urandom
The good; it is fast and small. The bad; it is deterministic, and the seed is small ( as noted by poncho in the comments) that prevents it from producing a cryptographically secure RNG from LCG.
-
1$\begingroup$ To add a small comment, apart from cryptography, I believe that even the best LCGs are no longer considered good for, say, Monte Carlo simulations. They're OK when you just need a few random numbers and don't care about the possibility that patterns in them will affect your oucomes. Yes, simple and fast is what they have in their favor. The programmer of the ligrary didn't have to do much work, and figured that if you had a serious need, you'd use something else. $\endgroup$ – Mars May 10 '19 at 3:34
$\begingroup$
$\endgroup$
/dev/urandom is the best approach to generate a seed for cryptography, but sometimes we need a secure deterministic PRNG in order to compute its sequence in two sides using the same /dev/urandom; I'm talking about CSPRNG (Cryptographically Secure Pseudo Random Number Generators). My advice is to look at a Salsa20 implementation (eg. Chacha20). Those are cryptographycally secure algorithms and probably the best you can find. Another options for cryptographic purposes are the following: Blum-Micali, ISAAC, Yarrow and Fortuna. Perhaps we'd like to discuss about which one is the faster among the CSPRNG.
-
$\begingroup$ Mersenne Twister is most certainly not cryptographically secure. It may have perfectly wonderful statistical properties (I'm not an expert there), but you (for example) certainly wouldn't want to use it to do shuffling in a poker game... $\endgroup$ – poncho Feb 28 at 14:36
-
