Re: Microsoft .NET PRNG

> I have read both FoundStone's and @Stakes reviews of the PRNG included with
> the Microsoft .NET 1.1 framework (also the Win32 CryptoAPI) , however there
> is little information available (that I have been able to locate) that
> discusses the actual method used, or an analysis of how reliable it is from
> a cryptographic perspective.
> 
> I don't profess to be expert enough on random number generation and
> cryptography to criticize the implementation, however I would like to know
> more about it as most code samples I have seen and now an application I am
> auditing is relying extensively on the CryptoAPI to provide facilities for
> random key generation.
> 
> Does anyone have any technical resources which discuss concerns or
> commendations of the implementation?

I don't know about the specific PRNG, but I can point you to
some PRNG references in general including what can go wrong
with a bad generator.


  http://www.taygeta.com/random.xml

Whether a PRNG is good or bad can depend upon the application.
Just because a particular one is suitable for a Monte Carlo calculation
does not mean it will be necessarily suitable for cryptographic uses.
The analysis of the algorithm has to have the application in mind.


Skip



-- 
 Dr. Everett (Skip) Carter      Phone: 831-641-0645 FAX:  831-641-0647
 Taygeta Scientific Inc.        INTERNET: [email protected]
 1340 Munras Ave., Suite 314    WWW: http://www.taygeta.com
 Monterey, CA. 93940