Problem - Kevin Tafuro

#define SPC_RC4RNG_UNLOCK( ) ReleaseMutex(hSpcRC4RNGMutex)
#endif
#define SPC_ARBITRARY_SIZE 16
unsigned char *spc_rand(unsigned char *buf, size_t l) {
static unsigned char zeros[SPC_ARBITRARY_SIZE] = {0,};
unsigned char *p = buf;
#ifdef WIN32
if (!hSpcRC4RNGMutex) hSpcRC4RNGMutex = CreateMutex(0, FALSE, 0);
#endif
SPC_RC4RNG_LOCK( );
while (l >= SPC_ARBITRARY_SIZE) {
RC4(&spc_prng, SPC_ARBITRARY_SIZE, zeros, p);
l -= SPC_ARBITRARY_SIZE;
p += SPC_ARBITRARY_SIZE;
}
if (l) RC4(&spc_prng, l, zeros, p);
SPC_RC4RNG_UNLOCK( );
return buf;
}
Note that, although we don’t show it in this code, you should ensure that the generator
is initialized before giving output.
Because using this RC4 API requires encrypting zero bytes to get the keystream output,
in order to be able to generate data of arbitrary sizes, you must either dynamically
allocate and zero out memory every time or iteratively call RC4 in chunks of up
to a fixed size using a static buffer filled with zeros. We opt for the latter approach.
RC4 is only believed to be a strong source of random numbers for
about 2 30 outputs. After that, we strongly recommend that you reseed
it with new entropy. If your application would not conceivably use
that many outputs, it should generally be okay not to check that condition.
Using a generator based on a cryptographic hash function
The most common mistake made when trying to use a hash function as a cryptographic
pseudo-random number generator is to continually hash a piece of data.
Such an approach gives away the generator’s internal state with every output. For
example, suppose that your internal state is some value X, and you generate and output
Y by hashing X. The next time you need random data, rehashing X will give the
same results, and any attacker who knows the last outputs from the generator can
figure out the next outputs if you generate them by hashing Y.
588 | Chapter 11: Random Numbers
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.