Problem - Kevin Tafuro

If the generator is not seeded with enough entropy, this function could produce output
that may be insecure. In such a case, the function will return 0. Make sure that
you always check for this condition!
Do not, under any circumstances, use the API function, RAND_pseudo_
bytes( ). It is not a cryptographically strong PRNG and therefore is
not worth using for anything that has even a remote possibility of
being security-relevant.
You can implement spc_rand( ), the cryptographic pseudo-randomness function
from Recipe 11.2, by simply calling RAND_bytes( ) and aborting if that function
returns 0.
#include
#include
#include
unsigned char *spc_rand(unsigned char *buf, size_t l) {
if (!RAND_bytes(buf, l)) {
fprintf(stderr, "The PRNG is not seeded!\n");
abort( );
}
return buf;
}
See Also
Recipe 11.2
11.10 Getting Random Integers
Problem
Given a pseudo-random number generation interface that returns an array of bytes,
you need to get random values in the various integer data types.
Solution
For dealing with an integer that can contain any value, you may simply write bytes
directly into every byte of the integer.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Getting Random Integers | 605