RE: Microsoft .NET PRNG

The CPGenRandom(HCRYPTPROV, DWORD, BYTE*) function is both an implemented
function by the Cryptographic Service Providers (CSP) that ship with the
CryptoAPI, and it is also a required implemented function for a library that
implements a CSP.  The description found in the MSDN Documentation of that
function is not a depiction of what existing MS-CryptoAPI CSP PRNGS (sorry
about the acronym chain there :P) does to generate random numbers, but
rather broad suggestions on how to generate numbers more likely to appear
random.

This function is called by the CryptGenRandom(HCRYPTPROV, DWORD, BYTE*)
function which is the client interface to the CPGenRandom function as
implemented by a CSP.  

> -----Original Message-----
> From: Pablo Milano [mailto:[email protected]] 
> Sent: Friday, July 30, 2004 8:52 AM
> To: 'Yvan Boily'
> Cc: [email protected]
> Subject: RE: Microsoft .NET PRNG
> 
> I'm looking for the same information. I want to know which 
> method does MS
> Crypto API use in order to obtain "strong" random seeds. The 
> most in-deep
> information about this I could find was
> http://msdn.microsoft.com/library/default.asp?url=/library/en-
> us/seccrypto/s
> ecurity/cpgenrandom.asp. Anyway, I'm still not sure if what 
> is explained
> there is what the function SHOULD do, or what the function 
> ACTUALLY DOES.
> Any help would be appreciated.
> Regards.
> 
> > -----Mensaje original-----
> > De: Yvan Boily [mailto:[email protected]] 
> > Enviado el: Miércoles, 28 de Julio de 2004 04:40 p.m.
> > Para: [email protected]
> > Asunto: Microsoft .NET PRNG
> > 
> > 
> > I have read both FoundStone's and @Stakes reviews of the PRNG 
> > included with
> > the Microsoft .NET 1.1 framework (also the Win32 CryptoAPI) , 
> > however there
> > is little information available (that I have been able to 
> locate) that
> > discusses the actual method used, or an analysis of how 
> > reliable it is from
> > a cryptographic perspective.
> > 
> > I don't profess to be expert enough on random number generation and
> > cryptography to criticize the implementation, however I would 
> > like to know
> > more about it as most code samples I have seen and now an 
> > application I am
> > auditing is relying extensively on the CryptoAPI to provide 
> > facilities for
> > random key generation.
> > 
> > Does anyone have any technical resources which discuss concerns or
> > commendations of the implementation?
> > 
> > Regards,
> > 
> > Yvan Boily
> > 
> > 
> 
>