5 ms·

For cryptography, there's really no reason to use rand(), mt_rand(), or the other insecure variants. No excuse, I should say. Just use urandom. Or getentropy()

For cryptography, there's really no reason to use rand(), mt_rand(), or the other insecure variants. No excuse, I should say. Just use urandom. Or getentropy() if your OS supports it. If you're not using it for cryptographic purposes, then I don't see why it matters. :)

jsnell 12y ago
There are all kinds of apps that might not need crypto quality randomness, but do at least need the random number streams to be different between invocations of the program! A Monte Carlo simulation that always gets the same results isn't going to be too hot. A game that seeds the RNG with 16 bits of entropy will be fine for a single player, but not for a community. (Think of FreeCell or Minesweeper in Windows, though those might even have been just 15 bits).
- sarciszewski 12y ago
  > There are all kinds of apps that might not need crypto quality randomness, but do at least need the random number streams to be different between invocations of the program! If you need high quality randomness, you probably should use urandom. If no where else, when the program is first executed. And if you're on Windows: https://github.com/php/php-src/blob/e6ea376a91514c59d21f4b53ccbb8c06fa42447b/win32/winutil.c#L80-L123 https://github.com/php/php-src/blob/e6ea376a91514c59d21f4b53...
  - pbsd 12y ago
    On Windows, the easy way is to call `rand_s`: http://msdn.microsoft.com/en-us/library/sxtz2fa8.aspx http://msdn.microsoft.com/en-us/library/sxtz2fa8.aspx
- conistonwater 12y ago
  > A Monte Carlo simulation that always gets the same results isn't going to be too hot. A Monte Carlo simulation absolutely needs to be able to produce the same numbers every time if you want to have a hope of debugging it. In a release version, yes, sure. But even there, people will still have concerns about replicating other people's results, so being careful with random seeds is important.
  - smeyer 12y ago
    There's a difference between "always uses the same seed" and "can be seeded for reproducibility". You probably want the latter and probably don't want the former.
glass- 12y ago
> If you're not using it for cryptographic purposes, then I don't see why it matters. :) There was a program I was using that used libtommath, and used that library's mp_rand function. libtommath's mp_rand does various trickery but essentially adds two results of rand() together[0]. If you call rand() multiple times on OpenBSD you will get a sequence that alternates between odd and even, which is completely standards compliant. Because of this the result of adding two rand() results together will always be odd (odd + even = odd). The program didn't need cryptographic levels of randomness, but only returning odd numbers turned out to be a bit of a problem. [0] https://github.com/libtom/libtommath/blob/develop/bn_mp_rand.c https://github.com/libtom/libtommath/blob/develop/bn_mp_rand...
- sarciszewski 12y ago
  That's really fascinating! :D

jsnell 12y ago

There are all kinds of apps that might not need crypto quality randomness, but do at least need the random number streams to be different between invocations of the program! A Monte Carlo simulation that always gets the same results isn't going to be too hot. A game that seeds the RNG with 16 bits of entropy will be fine for a single player, but not for a community. (Think of FreeCell or Minesweeper in Windows, though those might even have been just 15 bits).

sarciszewski 12y ago
> There are all kinds of apps that might not need crypto quality randomness, but do at least need the random number streams to be different between invocations of the program! If you need high quality randomness, you probably should use urandom. If no where else, when the program is first executed. And if you're on Windows: https://github.com/php/php-src/blob/e6ea376a91514c59d21f4b53ccbb8c06fa42447b/win32/winutil.c#L80-L123 https://github.com/php/php-src/blob/e6ea376a91514c59d21f4b53...
- pbsd 12y ago
  On Windows, the easy way is to call `rand_s`: http://msdn.microsoft.com/en-us/library/sxtz2fa8.aspx http://msdn.microsoft.com/en-us/library/sxtz2fa8.aspx
conistonwater 12y ago
> A Monte Carlo simulation that always gets the same results isn't going to be too hot. A Monte Carlo simulation absolutely needs to be able to produce the same numbers every time if you want to have a hope of debugging it. In a release version, yes, sure. But even there, people will still have concerns about replicating other people's results, so being careful with random seeds is important.
- smeyer 12y ago
  There's a difference between "always uses the same seed" and "can be seeded for reproducibility". You probably want the latter and probably don't want the former.

glass- 12y ago

> If you're not using it for cryptographic purposes, then I don't see why it matters. :) There was a program I was using that used libtommath, and used that library's mp_rand function. libtommath's mp_rand does various trickery but essentially adds two results of rand() together[0]. If you call rand() multiple times on OpenBSD you will get a sequence that alternates between odd and even, which is completely standards compliant. Because of this the result of adding two rand() results together will always be odd (odd + even = odd). The program didn't need cryptographic levels of randomness, but only returning odd numbers turned out to be a bit of a problem. [0] https://github.com/libtom/libtommath/blob/develop/bn_mp_rand.c https://github.com/libtom/libtommath/blob/develop/bn_mp_rand...

sarciszewski 12y ago
That's really fascinating! :D