CODEWITHSUNDEEP
c++randomrsa
Rudy132
Rudy132

Reputation: 25

Unpredictable pseudo-RNG

I'm working on a cryptography project in C++ for school, and I'm going to need a way to generate random numbers that can't be regenerated by someone else (who "guessed" the seed).
To be precise, I'd need either a pure random generator, or a way to get 100% "secure" seed. I've already done some research and thinking, and I've found two ways I could do it, the first way of doing it would be initialising the seed with the current time, but this leaves me to worry that the "hacker" might find out the moment of the generation of the key, and then they'll have the seed, and therefore will be able to predict the next generated numbers. The second way of doing it I found was to ask the user for a seed.
Now, what if I don't want the user to generate the key ? And are my worries about the time-based seed founded or are they just pure paranoia ? Is there a chance anyone could get the execution moment for the code ? Or are there maybe other ways of doing it that I've missed ?
Sidenote: I'm using the random_default_engine from <random>

Upvotes: 1

Views: 141

Answers (1)

MSalters
MSalters

Reputation: 179819

user1095108 had the right idea, but the comment probably was too short.

Ask the user to type something at random. Each character is about 1 bit of randomness. Users are pretty bad at choosing random characters. Yet, you'll need about 40-50 bits.

However, users are also pretty bad at typing at an exact rhythm. The timing of each keystroke adds an extra few bits of randomness, depending on how accurately your OS can report that. With millisecond resolution, 10 keystrokes should be enough.

Upvotes: 2

Related Questions