Re: Microsoft .NET PRNG

Before this thread ends, I wanted to point out a few other 
things:

First, in response to the original question, the 
RNGCryptoServiceProvider is basically a managed code 
wrapper to the CryptoAPI CryptGenRandom API function. This 
is generally considered random enough for most purposes, 
and it is FIPS 140-1 compliant, but certainly could be 
improved upon. If you think that someone really really 
wants your data you may look into other options.

CryptGenRandom pulls data from a variety of sources to 
seed the PRNG. The data is based on time, processes, 
environment, counters, and low-level system information. 
 MD4 hashes create entropy from this seed data. 

If you believe that this seed data is not sufficient, then 
you can certainly gather your own entropy data and feed it 
into the user-provided CryptoAPI buffer or pass it when 
you initialize the RNGCryptoServiceProvider class. Or you 
could combine the RNGCryptoServiceProvider result with 
your own entropy data and then take a hash of that.

If you believe that the hashing algorithm used is not 
sufficient, you could hash it again with any algorithm you 
think is better. Or if you don't trust any hashing 
algorithm you can hash multiple times using a different 
algorithm for each round. 

And you certainly can get a third party CSP if you trust 
another more than the one that Microsoft built.

One more thing: this only applies to 
RNGCryptoServiceProvider not the System.Random class. 
System.Random is based on a predictable function and is 
not considered a strong random number generator.

Mark Burnett


Hacking the Code - ASP.NET Web Application Security
http://www.hackingthecode.com


On Fri, 30 Jul 2004 09:32:03 -0700
  Skip Carter <[email protected]> wrote:
>
>> I have read both FoundStone's and @Stakes reviews of the 
>>PRNG included with
>> the Microsoft .NET 1.1 framework (also the Win32 
>>CryptoAPI) , however there
>> is little information available (that I have been able 
>>to locate) that
>> discusses the actual method used, or an analysis of how 
>>reliable it is from
>> a cryptographic perspective.
>> 
>> I don't profess to be expert enough on random number 
>>generation and
>> cryptography to criticize the implementation, however I 
>>would like to know
>> more about it as most code samples I have seen and now 
>>an application I am
>> auditing is relying extensively on the CryptoAPI to 
>>provide facilities for
>> random key generation.
>> 
>> Does anyone have any technical resources which discuss 
>>concerns or
>> commendations of the implementation?
>
>I don't know about the specific PRNG, but I can point you 
>to
>some PRNG references in general including what can go 
>wrong
>with a bad generator.
>
>
>  http://www.taygeta.com/random.xml
>
>Whether a PRNG is good or bad can depend upon the 
>application.
>Just because a particular one is suitable for a Monte 
>Carlo calculation
>does not mean it will be necessarily suitable for 
>cryptographic uses.
>The analysis of the algorithm has to have the application 
>in mind.
>
>
>Skip
>
>
>
>-- VB.NET C# code audit sql injection 
> Dr. Everett (Skip) Carter      Phone: 831-641-0645 FAX: 
> 831-641-0647
> Taygeta Scientific Inc.        INTERNET: 
>[email protected]
> 1340 Munras Ave., Suite 314    WWW: 
>http://www.taygeta.com
> Monterey, CA. 93940       
> secret questions     
>crypto passwords
>
>
>
>
>
>
>
>
>