Re: [Dev-C++] true random numbers.

> I would assume your first rand() call always produces the same result,
> i.e. that you seed the random number generator with a constant multiplied
> with the current time. 

Yes, the first rand() always produces the same result... but
multiplyed by a different value of current time, we can obtain a
different seed to further random values

Let suppose two different executions E1 and E2:

srand( (unsigned)time( NULL ) *rand()/RAND_MAX ); 

the first call of rand() is the same in execution 1 and 2. But the
srand is seeded with different values  N1 and M1. (due to different
times)

Then we obtain a random number RN1 and RN2 that will be different.

Then we re-seed the sequence again
srand( (unsigned)time( NULL ) *rand()/RAND_MAX ); 
both values in the mulplitication are different so, we are seeding
again with two different seeds....

And so on... Every time you need a random value.. the sequece is
re-seeded with current time and the next existing random value..

I think it is a easy way in order to complicate the analysis.... 


> No much differene from the all-time "favorite" of
> using process PID multiplied with time(). A large number of applications
> have done this for generating session keys or similar. A short analysis
> makes this approach obvious and an attacker may then find out a very small
> range of possible seed values when trying to recreate the random sequence
> used. Don't forget that most of the programs in the world are built using
> a small set of runtime libraries. The runtime libraries are created using
> an even smaller set of standard pseudo-random number generators.

I dont think that this is perfect... but I believe that this can
minimize the risk, seeing that you only get a single number of a
sequence (you are reseeding it continously)

> When just generating some semirandomnes for "fun" in an application, this
> doesn't much matter. 

I agree...

> However, as soon as the random sequences are used for
> some soft of security, the seed becomes very important, and it might also
> be an idea to think about the sequence, since max 2^32 sequences may be
> created, which is very easily scanned.
> 

Of course.... the pseudo random algorithms are becoming a proper
science.... in fact, a way for atack secure systems like RSA is with
atacks to the builtin pseudo ramdom algorithms... so you can reduce
dramatically the range of possible keys.. for example.

Bye! 

-- 
Aitor Moreno
   ait...@gm...