112 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of ...
user avatar
  • 43.5k
49 votes
Accepted

Can you use memory errors as a source of randomness for cryptography?

(..) would it be viable to allocate a very large amount of memory (perhaps in a long loop) and use the errors that eventually occur as a source of randomness? No. Practical use of memory errors as a ...
user avatar
  • 125k
45 votes
Accepted

What is the practical impact of using System.Random which is not cryptographically random?

You asked for the practical impact, so the answer is that for \$120 I could probably have your entire password database done by tomorrow. Here is your program, or something similar to it: ...
user avatar
  • 658
39 votes
Accepted

What does it mean for a random number generator to be cryptographically secure?

What are the criteria that make an RNG cryptographically secure? In short, a DRBG [deterministic random bit generator] is formally considered computationally secure if a computationally-limited ...
user avatar
36 votes

Can I encrypt a message by swapping bits in the text?

First problem is you're not specifying at all how many swaps you need to do for a given message length, other than saying it's "several." For an $n$-bit messsage there are $n!$ ways of rearranging its ...
user avatar
35 votes

Cryptography's random number problem?

The title of this article is complete hype. Tip: when a journalist says “X could solve Y”, read “X probably won't solve Y”. Much of the content of the article is hype too. Cryptography has a random ...
user avatar
35 votes
Accepted

Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

Define $H(x) = \operatorname{SHA-256}(x) \mathbin\| 1$; that is, append a single 1 bit to SHA-256. Can you find a collision under $H$? Does $H$ have anything resembling uniform distribution? This ...
user avatar
34 votes

Why is the output of a True Random Number Generator (TRNG) insecure after it has been compressed?

I think you're misinterpreting the source. The source says the TRNGs "rely" on compression (a cryptographic hash would be the compression function, or possibly some simpler function to ...
user avatar
  • 1,391
33 votes
Accepted

Why are PRNG in programming languages not cryptographically secure by default?

First, insecure PRNGs are typically faster than CSPRNGs. CSPRNGs based on /dev/urandom (if you're familiar with Linux), for example, have to call the crypto kernel module driver every time. For ...
user avatar
  • 476
32 votes
Accepted

A website that identifies an RNG from its output

A colleague of mine told me about a website that, given a sufficient quantity of output from an PRNG, had been able to deduce which application the PRNG was from. As you correctly identified this ...
user avatar
  • 44.7k
31 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology ...
user avatar
28 votes

A website that identifies an RNG from its output

One tool that tries to do this is untwister. It's almost certainly not the tool you were thinking of, though, as it cannot determine if the output came from OpenSSL specifically. It can determine ...
user avatar
26 votes
Accepted

What is the difference between TRNG and CSPRNG?

A True Random Number Generator uses a physical phenomenon not known to be fully deterministic as origin of the discrete values (bits or integer numbers) that it outputs. That phenomenon can for ...
user avatar
  • 125k
26 votes

What is the practical impact of using System.Random which is not cryptographically random?

From what you have described, it sounds like your system works as follows: Consult the system clock to find a 32-bit seed $s$. Use System.Random to generate a ...
user avatar
26 votes
Accepted

Can we use a Cryptographic hash function to generate infinite random numbers?

This construction gives you cryptographic-quality pseudorandom output, but it isn't as secure as it can be for a random generator. With commonly used hash functions $H$ (such as any of the SHA2 and ...
user avatar
26 votes
Accepted

The GCD strikes back to RSA in 2019 - Good randomness is the only solution?

The solution is simply to make sure that you have good randomness. At the size of the numbers we are considering, the probability of a repeat when using good randomness is extremely small. To make ...
user avatar
23 votes
Accepted

Is it safe to seed a random number generator from system time?

Yes, it is unsafe to seed a PRNG with only with the system time. No, that's not all Bouncy Castle's SecureRandom does. The ...
user avatar
20 votes
Accepted

RFC6979: error in reference implementation?

The RFC specifies things in terms of bits. Each call to HMAC outputs hlen bits. tlen is the count of bits obtained so far; when ...
user avatar
19 votes

What is the difference between CSPRNG and PRNG?

The key element in the definition of a PRG is the observer (aka distinguisher, algorithm, test, etc) that the PRG is supposed to fool. A statistical PRG fools a specific set of observers, whereas a ...
user avatar
19 votes

Entropy of two concatenated random values

Even in context, much of what is written in the blog post makes no sense. E.g., it says: While it can be argued that the DRNG is in reality just splitting a 128-bit value into two pieces and ...
user avatar
19 votes
Accepted

Where do Windows applications get entropy from?

Update: Since I wrote this post, CryptGenRandom has been deprecated. Apparently it is now recommended to use BCryptGenRandom ...
user avatar
  • 31.3k
19 votes
Accepted

Why does BCRYPT_RNG_DUAL_EC_ALGORITHM get removed from CNG API on Windows 10?

The Government's elliptic curve backdoor is real, isn't it? We don't know for sure, but there are indicators into that direction. More importantly though, yes, you can backdoor the RNG, as was ...
user avatar
  • 44.7k
19 votes
Accepted

Is openssl rand command cryptographically secure?

Yes, it is cryptographically secure, pseudo random output, seeded by retrieving secure random data from the operating system. If it is random or not depends on the fact if the OS RNG is random. This ...
user avatar
  • 85.8k
18 votes
Accepted

Mixing Entropy Sources by XOR?

If one source remains uncompromised plus statistically random on all bits, and both sources remain independent, then a xor of both sources together can also be ...
user avatar
  • 1,089
18 votes

What is the practical impact of using System.Random which is not cryptographically random?

The official documentation for System.Random explicitly says it should not be used for generating passwords. It’s predictable, and seeded only from the system clock. This means System.Random has at ...
user avatar
  • 2,217
18 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. ...
user avatar
17 votes

What tests can I do to ensure my random number generator is working correctly?

What tests can I do to ensure my PRNG is working correctly? That depends on what exactly you mean by “working correctly”. You can do statistical tests to check for various statistical flaws your ...
user avatar
  • 17.4k
17 votes
Accepted

Does using modulo (%) affect quality of randomness?

Let me begin by saying that if you have a hardware source of randomness, you don't need to be stingy with it. 1) Does modulo affect the quality of randomness, faking in some way the distribution of ...
user avatar
  • 4,198
17 votes

Are there any practical ways to transfer random data securely?

Is it possible to securely transfer random values in such a way that they are still viable for use in cryptography? Yes and this is done all the time. If you use a TLS_RSA cipher suite, the client ...
user avatar
  • 31.3k
17 votes

What does it mean for a random number generator to be cryptographically secure?

I tried to use mostly non-jargon to make it more understandable than the current top answer. What are the criteria that make an RNG cryptographically secure? From en.wikipedia.org/wiki/CSPRNG: ...
user avatar
  • 1,406

Only top scored, non community-wiki answers of a minimum length are eligible