115 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of ...
kelalaka's user avatar
  • 47.6k
50 votes
Accepted

Can you use memory errors as a source of randomness for cryptography?

(..) would it be viable to allocate a very large amount of memory (perhaps in a long loop) and use the errors that eventually occur as a source of randomness? No. Practical use of memory errors as a ...
fgrieu's user avatar
  • 138k
46 votes
Accepted

What is the practical impact of using System.Random which is not cryptographically random?

You asked for the practical impact, so the answer is that for \$120 I could probably have your entire password database done by tomorrow. Here is your program, or something similar to it: ...
ymbirtt's user avatar
  • 668
40 votes
Accepted

What does it mean for a random number generator to be cryptographically secure?

What are the criteria that make an RNG cryptographically secure? In short, a DRBG [deterministic random bit generator] is formally considered computationally secure if a computationally-limited ...
Stephen Touset's user avatar
38 votes

Cryptography's random number problem?

The title of this article is complete hype. Tip: when a journalist says “X could solve Y”, read “X probably won't solve Y”. Much of the content of the article is hype too. Cryptography has a random ...
Gilles 'SO- stop being evil''s user avatar
36 votes

Can I encrypt a message by swapping bits in the text?

First problem is you're not specifying at all how many swaps you need to do for a given message length, other than saying it's "several." For an $n$-bit messsage there are $n!$ ways of rearranging its ...
Luis Casillas's user avatar
35 votes
Accepted

Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

Define $H(x) = \operatorname{SHA-256}(x) \mathbin\| 1$; that is, append a single 1 bit to SHA-256. Can you find a collision under $H$? Does $H$ have anything resembling uniform distribution? This ...
Squeamish Ossifrage's user avatar
34 votes

Why is the output of a True Random Number Generator (TRNG) insecure after it has been compressed?

I think you're misinterpreting the source. The source says the TRNGs "rely" on compression (a cryptographic hash would be the compression function, or possibly some simpler function to ...
Serpent27's user avatar
  • 1,441
32 votes
Accepted

Why are PRNG in programming languages not cryptographically secure by default?

First, insecure PRNGs are typically faster than CSPRNGs. CSPRNGs based on /dev/urandom (if you're familiar with Linux), for example, have to call the crypto kernel module driver every time. For ...
A. Darwin's user avatar
  • 466
32 votes
Accepted

A website that identifies an RNG from its output

A colleague of mine told me about a website that, given a sufficient quantity of output from an PRNG, had been able to deduce which application the PRNG was from. As you correctly identified this ...
SEJPM's user avatar
  • 45.7k
31 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology ...
thesquaregroot's user avatar
29 votes

A website that identifies an RNG from its output

One tool that tries to do this is untwister. It's almost certainly not the tool you were thinking of, though, as it cannot determine if the output came from OpenSSL specifically. It can determine ...
ChrisInEdmonton's user avatar
26 votes
Accepted

What is the difference between TRNG and CSPRNG?

A True Random Number Generator uses a physical phenomenon not known to be fully deterministic as origin of the discrete values (bits or integer numbers) that it outputs. That phenomenon can for ...
fgrieu's user avatar
  • 138k
26 votes

What is the practical impact of using System.Random which is not cryptographically random?

From what you have described, it sounds like your system works as follows: Consult the system clock to find a 32-bit seed $s$. Use System.Random to generate a ...
Squeamish Ossifrage's user avatar
26 votes
Accepted

Can we use a Cryptographic hash function to generate infinite random numbers?

This construction gives you cryptographic-quality pseudorandom output, but it isn't as secure as it can be for a random generator. With commonly used hash functions $H$ (such as any of the SHA2 and ...
Gilles 'SO- stop being evil''s user avatar
26 votes
Accepted

The GCD strikes back to RSA in 2019 - Good randomness is the only solution?

The solution is simply to make sure that you have good randomness. At the size of the numbers we are considering, the probability of a repeat when using good randomness is extremely small. To make ...
Yehuda Lindell's user avatar
21 votes
Accepted

Is there a cryptographic algorithm that can make a "lottery ticket"?

Bob picks an integer $n$ between 0 and 9 (inclusive), and a uniformly random 128-bit blinding factor $b$. Bob informs Alice of the hash commitment $c=H(n \mathbin\| b)$. $H()$ is a cryptographically ...
knaccc's user avatar
  • 4,712
20 votes
Accepted

Is openssl rand command cryptographically secure?

Yes, it is cryptographically secure, pseudo random output, seeded by retrieving secure random data from the operating system. If it is random or not depends on the fact if the OS RNG is random. This ...
Maarten Bodewes's user avatar
  • 91.7k
20 votes
Accepted

RFC6979: error in reference implementation?

The RFC specifies things in terms of bits. Each call to HMAC outputs hlen bits. tlen is the count of bits obtained so far; when ...
Thomas Pornin's user avatar
19 votes
Accepted

Where do Windows applications get entropy from?

Update: Since I wrote this post, CryptGenRandom has been deprecated. Apparently it is now recommended to use BCryptGenRandom ...
otus's user avatar
  • 32k
19 votes
Accepted

Why does BCRYPT_RNG_DUAL_EC_ALGORITHM get removed from CNG API on Windows 10?

The Government's elliptic curve backdoor is real, isn't it? We don't know for sure, but there are indicators into that direction. More importantly though, yes, you can backdoor the RNG, as was ...
SEJPM's user avatar
  • 45.7k
18 votes

What is the practical impact of using System.Random which is not cryptographically random?

The official documentation for System.Random explicitly says it should not be used for generating passwords. It’s predictable, and seeded only from the system clock. This means System.Random has at ...
rmalayter's user avatar
  • 2,287
18 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. ...
Jean-Baptiste Yunès's user avatar
17 votes

Are there any practical ways to transfer random data securely?

Is it possible to securely transfer random values in such a way that they are still viable for use in cryptography? Yes and this is done all the time. If you use a TLS_RSA cipher suite, the client ...
otus's user avatar
  • 32k
17 votes

What does it mean for a random number generator to be cryptographically secure?

I tried to use mostly non-jargon to make it more understandable than the current top answer. What are the criteria that make an RNG cryptographically secure? From en.wikipedia.org/wiki/CSPRNG: ...
Luc's user avatar
  • 1,498
16 votes
Accepted

Dice vs quantum random number generator

From the manufacturer's website: Quantis uses Quantum Physics to create truly random numbers Existing randomness sources can be grouped in two classes: software solutions, which can only ...
Elias's user avatar
  • 4,883
16 votes

Example of cryptography random number

What kind of numbers are needed for cryptography/security? Are those integers? Bits. Simply have your TRNG generate random bits. As mentioned in the other answer, the only difference between bits/...
Ella Rose's user avatar
  • 19.5k
15 votes
Accepted

Why do we require a CSPRNG's output to be indistinguishable from true random?

We simply strive for crypto that's as close as possible to ideal. Indistinguishably is the strongest property we can demand from a PRNG/streamcipher. It's hard to predict which non ideal properties ...
CodesInChaos's user avatar
  • 24.8k
15 votes
Accepted

Do hash functions need to "look random"?

The answer is most certainly not! Well, I sort of lied, since it depends on what you are doing. I'll explain. The basic property of hash functions is collision resistance, and this requires nothing ...
Yehuda Lindell's user avatar
15 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess." Your sample string is hard for a human to guess, but it isn't ...
JesseM's user avatar
  • 462

Only top scored, non community-wiki answers of a minimum length are eligible