liveBook · Manning

Randomness

As explained in Real-World Cryptography

Randomness is the property of outcomes or data being difficult to predict and lacking a discernible deterministic pattern.

A secret key, nonce, IV, challenge, or prime number is only as safe as the randomness used to create it. In cryptography, randomness means outcomes that are difficult to predict, not merely numbers that look varied or evenly distributed. section 8.0 section 8.1

Good cryptographic randomness has several practical requirements:

  • It must be unpredictable to an attacker; a uniform-looking sequence is not enough. section 8.1
  • It should come from operating-system randomness or a trusted standard or cryptography library when available. section 8.4
  • It must avoid predictable seeds, noncryptographic generators, and incorrectly used userland PRNGs. section 8.4

When randomness becomes a security failure

A calculator can simulate randomness by reading a stored list whose values have a good distribution. That is unsuitable for secrets because the sequence may be predictable. Similarly, a damaged OpenSSL PRNG used process IDs as seeds; on Linux, the limited process-ID range sharply reduced possible seeds and affected generated SSL and SSH keys. section 8.1 section 8.4

How Real-World Cryptography covers it

How deep it goes
Explains unpredictability, uniform distributions, physical sources, PRNG failures, and conservative sourcing, without implementation-level generation details.
Examples
Uses dice, lottery numbers, calculator sequences, chaotic physical phenomena, and the Debian-era OpenSSL PRNG failure.
What it assumes
Assumes familiarity with hash functions and message authentication codes before explaining randomness in cryptographic applications.
What you can do after
Apply it by choosing operating-system or trusted-library randomness and avoiding predictable or noncryptographic PRNGs.
How it connects
Connects randomness with cryptographic keys, nonces, IVs, challenges, prime numbers, hash functions, MACs, signatures, and PRNGs.

Also explained in

Compare how 5 books explain randomness →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.