4 ms·
Speaking from experience on this... you get some crazy looks from code reviewers. I got perhaps overclever with this at one point using it to generate passwords
by jerf 5y ago
Speaking from experience on this... you get some crazy looks from code reviewers. I got perhaps overclever with this at one point using it to generate passwords by extracting log2(44) bits progressive out of a random number to choose from my blessed set of characters for passwords and it took some patience with the security team to verify that it was safe.
I did it just because it's one of the more elegant ways out of the problem of truncation of bits when you have a non-even-power-of-two set of possibilities to choose from, especially when you need to do it repeatedly from a random source. Instead of discarding or fussing about, if you need fractional bits from a given random source of bits, you just... take fractional bits. No fuss. No muss.
- jhgb 5y ago> by extracting log2(44) bits progressive out of a random number to choose from my blessed set of characters for passwords and it took some patience with the security team to verify that it was safe. It's safe but if you somehow depended on all the passwords having exactly equal probability, you'd be wrong (unless you're already using a random number from a limited range). Of course this is easily fixed by a range check on the random number and generating it again if it failed the check.
- goldenkey 5y agoI also have written about using pairing functions to extract multiple random numbers from a single rand() call Your method is more concrete than mine, mine is math, yours is binary-based CS. https://churchofthought.org/blog/2019/07/24/an-ordered-variant-of-the-cantor-pairing-function/ https://churchofthought.org/blog/2019/07/24/an-ordered-varia...