Re: Microsoft .NET PRNG

Peter Gutmann's paper on randomness describes the algorithms used, at least in
some/most versions. It's possible it's been changed at some recent point in
time. You can find it here: http://www.cypherpunks.to/~peter/06_random.pdf.
It's summary is that "This generator is, at best, adequate." IMO it's probably
the weakest of all the ones described in the paper (which also covers PGP 2+5,
/dev/random, OpenSSL, several others).

-Jack

On Wed, Jul 28, 2004 at 02:40:05PM -0500, Yvan Boily wrote:
> 
> I have read both FoundStone's and @Stakes reviews of the PRNG included with
> the Microsoft .NET 1.1 framework (also the Win32 CryptoAPI) , however there
> is little information available (that I have been able to locate) that
> discusses the actual method used, or an analysis of how reliable it is from
> a cryptographic perspective.
> 
> I don't profess to be expert enough on random number generation and
> cryptography to criticize the implementation, however I would like to know
> more about it as most code samples I have seen and now an application I am
> auditing is relying extensively on the CryptoAPI to provide facilities for
> random key generation.
> 
> Does anyone have any technical resources which discuss concerns or
> commendations of the implementation?
> 
> Regards,
> 
> Yvan Boily