Randomness Is The Foundation
Keys, nonces, salts, and initialization vectors all depend on unpredictable randomness. If an attacker can guess these values, even perfect algorithms collapse.
Two Kinds Of Random
- An ordinary pseudo random generator is fast and statistically random but predictable if you know its seed or state. It is fine for simulations, never for keys.
- A cryptographically secure generator, a CSPRNG, is designed so that observing past outputs gives no advantage in predicting future ones.
Where Entropy Comes From
A CSPRNG is seeded from the operating system entropy pool, which gathers unpredictability from hardware events and dedicated hardware sources. The OS interface is the right place to draw secure random bytes.
Common Failures
- Seeding with the current time or a fixed value makes keys guessable.
- Reusing a generator state across processes can repeat nonces.
- A poorly seeded generator at boot, before entropy is gathered, can leak.
Always use the platform CSPRNG interface, never a plain language random function, for any security value.
Key idea
Cryptographic security depends on drawing keys, nonces, and salts from a properly seeded CSPRNG backed by operating system entropy, because predictable randomness from an ordinary generator breaks even flawless algorithms.