https://insinuator.net/tags/random-number-generator/ Recent content in Random Number Generator on Insinuator.net - Bold Statements Hugo en-us Thu, 29 Nov 2018 00:00:00 +0000 https://insinuator.net/2018/11/on-the-insecurity-of-math.random-and-its-siblings/ Thu, 29 Nov 2018 00:00:00 +0000 https://insinuator.net/2018/11/on-the-insecurity-of-math.random-and-its-siblings/ <p>During code reviews we often see developers using weak RNGs like <em>math.random()</em> to generate cryptographic secrets. We think it is commonly known that weak random number generators (RNG) must not be used for any kind of secret and recommend using secure alternatives. I explicitly did not state a specific language yet, because basically every language offers both weak and strong RNGs.</p> <p>So I asked myself: What if I use a weak RNG to generate a secret? Is it possible to recover the secret from some derived value, like a hash?</p>