Hacker News Reader

Comment by mbesto | Hacker News Reader

I think you're confusing the medium with which this achieved versus it's utility.

Surely you're not suggesting PRNG/DRBG isn't completely safe from hacking?

Real world RNGs get randomness from two sources: (1) the timings of random events on the machine (primarily network traffic), or (2) a hardware device that runs several oscillators on different clocks and detects coincidence in the derived square waves. Even #1 alone is normally sufficient in the real world. While you're right that there are attacks against RNGs, it's never going to be because an attacker gets control of every little bit of stray RF in your data center such that he can control the exact timing of packet arrival, packet retransmits, etc.

I don't even understand this question. Can you reword it?

Sure. I'm struggling to understand what utility your questioning. Is is it the fact that they are using a hardware based random generator or the way in which they are using a hardware generator (e.g. lava lamps)?

If the former - my question would be - surely you, as a security expert, would agree that a hardware random generator is more secure than a software based one (PseudoRandomNumberGenerator or DeterministicRandomBitGenerator)?

If the latter - why does the way in which they use a hardware generator matter as long as it provides some utility and advantage over a software-based one which has a deterministic set of numbers?

Reply on news.ycombinator.com