Re: Should we upgrade to a new PRNG in core?

* Russ Allbery <[email protected]> [2026-01-24 04:52]:
> The primary reason to use rand() is if you need predictable (i.e., not
> actually random) random numbers for test suites, reproducible
> randomized algorithms, and other similar purposes, or as a fallback on
> platforms without /dev/random or some equivalent.

Indeed. But within those confines there are still better algorithms and
worse ones. A well-designed PRNG with useful characteristics is a good
thing to have for use cases such as sampling and numerical algorithms
that do not require actual entropy and may in fact actively disprefer
it. So “do we want a better PRNG?” is a worthwhile question even if the
answer to “should one use rand() for cryptography?” is “absolutely not”
(as you are right to point out) “– that’s not what it’s for”.

> If /dev/random is available and you want random numbers for security
> purposes, you should just use it via Crypt::URandom, Crypt::Random,
> etc.

Let me take the opportunity to also plug Crypt::SysRandom here as the
better incarnation of Crypt::URandom.