Problem - Kevin Tafuro

Note that cryptographic pseudo-random number generators always produce an identical
stream of output when identically seeded. If you wish to repeat a stream of
numbers, you should avoid reseeding the generator (or you need to do the exact
same reseeding at the exact right time).
Discussion
Most common “random number generators,” which we will call noncryptographic
pseudo-random number generators, are not secure. They start with a seed (which
needs to be random in and of itself to have any chance of security) and use that seed
to produce a stream of numbers that look random from the point of view of a statistician
who needs random-looking but reproducible streams of data.
From the point of view of a good cryptographer, though, the numbers produced by
such a generator are not secure. Generally, noncryptographic generators leak information
about their internal state with each output, meaning that a good cryptographer
can start predicting outputs with high accuracy after seeing a few random
numbers. In a real system, you generally do not even need to see the outputs directly,
instead inferring information about the outputs from the behavior of the program
(which is generally made even easier with a bit of reverse engineering of the program).
Traditional noncryptographic pseudo-random number generators include the rand( )
and random( ) functions you’d expect to see in most libraries (so-called linear congruential
generators). Other noncryptographic generators include the “Mersenne
Twister” and linear feedback shift registers. If a random number generator is not
advertised as a cryptographic random number generator, and it does not output
high-entropy data (i.e., if it stretches out a seed instead of harvesting randomness
from some external input to the machine), do not use it.
Cryptographic pseudo-random number generators are still predictable if you somehow
know their internal state. The difference is that, assuming the generator was
seeded with sufficient entropy and assuming the cryptographic algorithms have the
security properties they are expected to have, cryptographic generators do not
quickly reveal significant amounts of their internal state. Such generators are capable
of producing a lot of output before you need to start worrying about attacks.
In the context of random number generation, entropy refers to the inherent
“unknowability” of inputs to external observers. As we discuss in Recipe 11.19, it is
essentially impossible to determine how unknowable something is. The best we can
do is to establish conservative upper limits, which is, in and of itself, quite difficult.
If a byte of data is truly random, then each of the 2 8 (256) possibilities are equally
likely, and an attacker would be expected to make 2 7 guesses before correctly identifying
the value. In this case, the byte is said to contain 8 bits of entropy (it can contain
no more than that). If, on the other hand, the attacker somehow discovered that
570 | Chapter 11: Random Numbers
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.