> I understand that having a PRNG that doesn't return numbers with even distribution across a range is bad. That's (potentially dangerously) oversimplified. Un

> I understand that having a PRNG that doesn't return numbers with even distribution across a range is bad. That's (potentially dangerously) oversimplified. Uniformity is one of the consequences rather than the requirement itself. The core requirement is unpredictability. If the output is non-uniform, it means the output isn't fully unpredictable (which may or may not lead to practical attacks depending on the degree of the problem and how the PRNG is actually being used). Meanwhile, you can also create a uniform PRNG that isn't secure at all (e.g. http://en.wikipedia.org/wiki/Mersenne_twister http://en.wikipedia.org/wiki/Mersenne_twister ).