Randomness and Determinism

• Computers are deterministic
• Pseudo-random generators are not random.
  Implementation of the C rand() function:
  #define RAND_MAX        0x7fffffff
  
  static u_long next = 1;
  
  int
  rand()
  {
          return ((next = next * 1103515245 + 12345) % ((u_int)RAND_MAX + 1));
  }
  
• We can guess the first number (simple arithmetic)
• Given a number we can guess the next
• Thus unsuitable for
  • Gambling applications
  • Generating random challenges (nonces) - subject to know plaintext attack
• Need to use non-deterministic input
• Sources
  • Radioactive source
  • Thermal noise (e.g. on chip random generator)
  • Noise from sound card
  • Mouse and keyboard input events
  • Network packet characteristics (adversary can affect them)
• All the above sources may not have a random distribution.
• Passing them through a message digest function can help.

• PreviousProblematic APIs
• Contents
• NextApplying Cryptography

 Last change: Friday, July 4, 2003 2:37 pm
 Unless otherwise expressly stated, all original material on this page created by Diomidis Spinellis is licensed under a Creative Commons Attribution-Share Alike 3.0 Greece License.