Cryptographically Secure PRNGs

A CSPRNG must satisfy: (1) next-bit unpredictability — knowing all previous bits, the next bit cannot be predicted with probability > 1/2 + negligible. (2) state compromise extension resistance — learning the current state reveals nothing about past output.

Linux /dev/urandom uses a CSPRNG seeded from the entropy pool. After initial seeding (128 bits of entropy), it is safe to use even when the pool is "empty" — the CSPRNG maintains its own internal state. getrandom() is the modern syscall equivalent.

Linux kernel 5.17+ replaced its CSPRNG with a ChaCha20-based design. ChaCha20 is fast (no hardware acceleration needed), provides 256-bit security, and has a well-understood security proof. Nonce is the counter; key comes from the entropy pool.

Fortuna (Ferguson & Schneier, 2003) is a CSPRNG design that maintains 32 entropy pools and accumulates entropy continuously. The generator is reseeded from pools as they fill. Resistant to RNG reset and partial state compromise attacks.

NIST SP 800-90A originally included DUAL_EC_DRBG, based on elliptic curves. Snowden documents revealed the NSA inserted a backdoor: the EC points were chosen so the NSA could predict output from any seed. Never use DUAL_EC_DRBG. NIST removed it in 2014.

CTR_DRBG (NIST SP 800-90A) uses AES in counter mode as the CSPRNG. Seed = 256-bit key + 128-bit nonce. Each call advances the counter. Widely implemented in OpenSSL, BoringSSL, and Windows BCrypt. Hardware-accelerated on AES-NI CPUs.

HASH_DRBG uses a hash function (SHA-256) iteratively with a seed value. HMAC_DRBG uses HMAC for mixing. HMAC_DRBG is simpler to implement correctly and is used in many embedded systems (mbedTLS, WolfSSL).

Even CSPRNGs must reseed periodically. CTR_DRBG has a reseed interval of 2^48 requests. Fortuna reseeds from its entropy pools. Manual reseeding: add fresh entropy (getrandom bytes) to the CSPRNG state at startup and after fork().

When a process forks, both parent and child inherit the same CSPRNG state — they will produce identical output. Fix: call getrandom() to reseed immediately after fork(). OpenSSL handles this automatically via pthread_atfork() in recent versions.

import secrets key = secrets.token_bytes(32) # 256-bit key nonce = secrets.token_bytes(12) # 96-bit nonce for AES-GCM pin = secrets.randbelow(10**6) # 6-digit PIN # Never use random module for cryptography

window.crypto.getRandomValues(typedArray) is the browser's CSPRNG. It calls the OS entropy source. Used by WebCrypto API for key generation. Never use Math.random() for security — it is a non-cryptographic PRNG seeded from system time.

Which Python module should you use to generate cryptographic random bytes?

CSPRNGs like ChaCha20, CTR_DRBG, and Fortuna generate unpredictable output from entropy seeds. Avoid DUAL_EC_DRBG, random.random(), and Math.random(). Use secrets (Python) or window.crypto (browser). Next: real-world entropy failures.