3 ms·
I'm sure I'll get roasted for this, but getting the right answer will scratch a years-old itch. Why aren't most random number generators seeded using the system
by tomcam 2y ago
I'm sure I'll get roasted for this, but getting the right answer will scratch a years-old itch. Why aren't most random number generators seeded using the system clock in addition to the existing algos?
- skybrian 2y agoIt's not entirely useless, but as a source of entropy, it's pretty predictable. You'd only get a few bits.
- YZF 2y agoseeding PRNGs from the system clock is quite common. Using the system time as a source of entropy for generating secure random numbers is problematic because it's not random. You want sources that are "noisy" to contribute. Let's say we're generating some private key, and using the time as a source, and then writing the cert to a file, you'd probably be able to get a pretty good idea from the timestamp of that file what the system time was when the private key was generated.
- whyever 2y agoNowadays, your operating system has a dedicated API for providing randomness (e.g. `getrandom` on Linux), so you would just use that to seed your RNG. Using the time is questionable, because an adversary can often estimate when the RNG was seeded, enabling brute-force attacks to reconstruct the seed.