Pseudo-random and true random number generators

A computer is a deterministic machine: the same inputs produce the same outputs. Generating randomness is therefore, by its very nature, a problem.

Pseudo-random number generators

A PRNG starts with an initial value — the seed — and generates a sequence through computation:

(seed) --> x1 --> x2 --> x3 --> ...

The sequence appears irregular, but it is entirely determined by the seed. Same seed, same sequence.

Those found in standard libraries, such as rand(), are designed for simulation or games: fast and well-distributed, but predictable. By observing a few outputs, one can deduce the internal state and predict the rest.

Never use them for cryptography. The function name does not give this away.

Cryptographic generators

A CSPRNG adds the missing guarantee: knowing past outputs does not allow one to guess the next ones, nor to work backwards to the internal state.

In practice, ask the operating system for one:

Platform	What to call
Linux, macOS	getrandom(), /dev/urandom
Windows	BCryptGenRandom()
In a browser	crypto.getRandomValues()

The system is best placed to do this: it continuously collects unpredictable data from the hardware.

Where does the unpredictability come from?

The system accumulates physical events that are difficult to reproduce — precise intervals between keystrokes, mouse movements, disk access times, and electrical noise from dedicated components.

It extracts a reserve of entropy from this, which feeds the generator.

The critical moment

Boot-up is the weak point. A virtual server that has just been created has no keyboard, no mouse and no history: its reserve is almost empty.

This is why freshly instantiated machines have been able to generate weak keys, sometimes identical from one machine to another. A 2012 study thus uncovered the private keys of tens of thousands of servers on the internet, simply because two of them shared a prime factor — a sign that their start-up randomisation was the same.