Why a key must be unpredictable

You can use AES-256 and a flawless protocol: if your key is predictable, the whole thing falls apart. It is the weakest link in the chain, and the one that is most often broken.

The number of keys does not equal security

An AES-256 key offers 2^256 possibilities, a number beyond reach. But this figure is only valid if all values are equally likely.

2^256     (possible solutions on paper)
2^20      (the actual current drawn if the generator is faulty)

An attacker never targets the theoretical space. They attack the one that your generator actually produces. A key selected at random from a million is cracked in a matter of seconds, regardless of its length.

The fallacy

Many programmers think: ‘This number is complex, so it’s unpredictable’. The two concepts are entirely unrelated.

The timestamp 1753225200 seems arbitrary. But if the attacker knows to the nearest second when the key was created, they are left with only a few thousand values to test.

Unpredictable does not mean complicated. It means that the attacker cannot narrow down the set of possibilities.

Where chance comes into play

It is not just the keys. In a protocol, the following are chosen at random:

• the keys for encryption and the session key;
• the initialisation vectors for CBC and the nonces for CTR;
• the secret exponents for Diffie-Hellman;
• session tokens and reset identifiers.

Each of these randomisations presents an opportunity to compromise the entire system. A predictable nonce in CTR mode, and two messages end up being encrypted in exactly the same way.

What is required

A cryptographic generator must guarantee that, even if all previous outputs are known, the next one cannot be predicted any better than by chance. This is a far stricter requirement than simply ‘the numbers appear to be well distributed’.