Source
MCRusher•

I use a crossplatform lib I wrote that uses bcrypt for windows rng and just reading from /dev/random on unix.

Should I change it or smth?

2
deepcubeOP•

Nope. Using a known good source of entropy on a per OS basis is a good thing. This paper just gives a few examples that could be useful if you need or want the generator in your own code for some reason. The one thing I'd recommend is urandom over random unless it's very early in the boot sequence. https://www.2uo.de/myths-about-urandom

2
MCRusher•

Thanks a lot, I know very little about how unix systems work and I just worked by reading man pages, so, and testing on an online unix-based ide.

I chose random because the pages said urandom may not exist for all systems or something. Is this not a real concern?

Sorry if this is a dumb question, what does it mean for "blocking"? I assumed it meant the code won't continue until the number is ready to be generated and thought that would be a good thing.

As for bcrypt, do you have an opinion on it? I believe it's the current (since vista) winapi CSPRNG system that seeds itself (from god-knows-where, can't find any implementation details, as is frustratingly typical of windows systems). I'm using the "let the system decide" setting for picking an algorithm since when I set it, generation failed because my version of win10 doesn't implement that alg.

2
anna_rchiste•

Is this not a real concern?

Well, is it your concern? What is your target platform?

2
MCRusher•

I just want it to work on most modern OS with similar behavior.

That's why I have support for windows and unix systems.

1
anna_rchiste•

Rule 1
Do not use system generators.
ALWAYS USE YOUR OWN RANDOM NUMBER GENERATOR.

Please, don't.
Don't roll your own PRNG (and please, PLEASE don't roll your own CSPRNG, don't roll your own crypto).
Unless it's literally your field of expertise and you have the programming expertise to implement it correctly, don't.

1
deepcubeOP•

We always hear, "don't use rand()!" but rarely is that followed up with a good suggestion of what you should use. This paper gives some small simple prngs that pass various randomness tests.

0