3 ms·
I think I never used PRNG in any serious software, but it surprised me as intuitively I would've assumed that using the same RNG in as many places as possible w
by iforgotpassword 3y ago
I think I never used PRNG in any serious software, but it surprised me as intuitively I would've assumed that using the same RNG in as many places as possible would make it harder to perform such an attack, because it would make it less likely you can observe enough places at which it is updated, but this was a pretty impressive and fun demonstration that this is false.
- IshKebab 3y agoPretty much all serious software uses PRNG at some point. Unless you mean you use CSPRNG, which is the easy fix.
- iforgotpassword 3y agoYeah it's obviously biased to the field you work in. And I'm aware that libs im using use some form of randomness, be it for uuid-gen, entropy for SSL or whatnot, but I seriously can't remember the last time I called rand() and friends directly for anything.
- adra 3y agoHi about pulling a sample of good random every N invocations to still allow for fast PRNG but to ideally defeat these schemes. Maybe use the real signals RNL value to seed the PRNG. Just a thought.