Start with two bit strings
Which 8-bit string is more likely to come from a fair generator?
11010110
00000000
Most people choose the first one because it looks mixed. Under a uniform process, however, every exact 8-bit string has the same probability: 1 out of 256. The all-zero string is unusual-looking, but it is not impossible or less likely than any other exact string.
This is the first important rule of cryptographic randomness:
Judge the process, not the appearance of one output.
This lesson follows Chapter 2 of Serious Cryptography, second edition. The browser lab makes the chapter's core ideas visible without requiring software, command-line tools, or an account.
Why cryptography needs randomness
Cryptographic systems use unpredictable values for tasks such as:
- creating secret keys;
- creating session and password-reset tokens;
- producing nonces and initialization values;
- adding salts; and
- making some encryption and signature operations behave safely.
A strong algorithm can fail if these values are predictable. If an attacker can recreate a key-generation process, the attacker may not need to break the cipher at all.
Randomness is not a decorative extra. It is an input to the security claim.
Random-looking is not the same as random
A sequence can look messy and still be completely predictable. A sequence can also contain a visible pattern even though it came from a fair process.
Consider a fair coin flipped eight times. These exact outcomes have equal probability:
HTTHHTHT
HHHHHHHH
The second outcome catches our attention because all flips match. That reaction describes human pattern recognition, not the probability of the exact sequence.
Two common reasoning errors follow:
- Mistaking nonrandomness for randomness: trusting a predictable generator because its output looks complicated.
- Mistaking randomness for nonrandomness: rejecting a legitimate output merely because it contains a pattern.
Statistical tests can help describe a large body of outputs, but passing those tests does not prove cryptographic unpredictability. A generator may produce balanced, random-looking data while an attacker who learns its state can predict what comes next.
Probability distributions
A probability distribution lists possible outcomes and assigns each a probability. All probabilities in the distribution must add to 1.
A uniform distribution gives every possible outcome the same probability. For a fair six-sided die, each face has probability 1/6. For a uniformly selected 8-bit value, each of the 256 possible strings has probability 1/256.
A biased or nonuniform distribution makes some outcomes more likely than others. If a token generator favors certain digits, an attacker can try the favored values first. Even a small bias can matter when a system generates many secrets.
| Distribution | What it means | Security concern |
|---|---|---|
| Uniform | Every outcome in the set is equally likely | Attackers gain no advantage from favoring one outcome |
| Biased | Some outcomes are more likely | Effective uncertainty is lower |
| Unknown | Probabilities have not been justified | The security claim is unsupported |
Uniform does not automatically mean unpredictable. A deterministic teaching generator can produce evenly distributed outputs and still be easy to replay. Distribution and predictability are related questions, but they are not the same question.
Entropy: uncertainty measured in bits
Entropy measures uncertainty in a distribution. More uncertainty means more entropy.
A fair coin toss has 1 bit of entropy because two equally likely outcomes are possible. A uniformly selected 8-bit value has 8 bits of entropy. A biased coin has less than 1 bit of entropy because one result is easier to predict.
For this course, focus on the idea before the formula:
- more equally likely possibilities → more uncertainty;
- more bias or predictability → less uncertainty;
- an n-bit container cannot hold more than n bits of entropy; and
- a 128-bit value is not automatically a 128-bit-strength secret if it came from a weak process.
A timestamp may be stored in 128 bits, but if an attacker can narrow it to a few thousand possibilities, its uncertainty is far smaller than 128 bits.
Entropy sources and random number generators
Computers are deterministic machines, so cryptographic randomness begins with uncertain observations from the physical environment or operating system. Examples include timing variations, hardware noise, device activity, and other events collected by the platform.
An entropy source supplies uncertain input. An RNG gathers or measures that uncertainty. Raw environmental observations may arrive slowly or contain bias, so systems do not normally hand those raw observations directly to every application.
Instead, the platform combines them with a pseudorandom generator.
environmental uncertainty → entropy collection → internal state → pseudorandom output
The operating system is responsible for much of this work. Application developers should normally request cryptographic randomness through a well-supported system or language API rather than trying to measure mouse movement, time, temperature, or network traffic themselves.
PRNGs are deterministic expanders
A pseudorandom number generator (PRNG) uses an initial value and internal state to produce a longer stream of random-looking values. Its core algorithm is deterministic: the same starting state produces the same sequence.
That determinism is useful for simulations and testing. A researcher can use the same seed to reproduce an experiment. It is dangerous when an attacker can guess or copy the state used for a secret.
Use the Seed Replay interaction above. The teaching generator is intentionally weak. Choose a seed, observe the stream, change the seed, and return to the first seed. The first stream appears again. Mixing the numbers more aggressively would not create new uncertainty; a deterministic calculation cannot manufacture entropy that was never present.
A production cryptographic generator manages a protected internal state, receives entropy, updates that state, and produces output. It should also be designed so that learning current state does not conveniently reveal past outputs, and fresh entropy can help make future outputs unpredictable again.
Cryptographic versus noncryptographic PRNGs
A noncryptographic PRNG aims at properties useful for simulations, sampling, procedural games, or repeatable tests. It may distribute values well while remaining predictable.
A cryptographically secure pseudorandom number generator (CSPRNG) is designed so an attacker cannot feasibly predict its output from observed values. It is the appropriate category for:
- encryption keys;
- password-reset links;
- session identifiers;
- authentication challenges;
- cryptographic nonces; and
- other security-sensitive values.
| Need | Appropriate choice |
|---|---|
| Repeatable unit test | Seeded deterministic PRNG |
| Cosmetic game behavior | General-purpose PRNG may be acceptable |
| Encryption key | CSPRNG supplied by the platform |
| Password-reset token | CSPRNG supplied by the platform |
| Cryptographic nonce | The construction's required secure generation method |
Do not build a CSPRNG as an application exercise and do not substitute a general-purpose random function for a security API. In real work, use the current cryptographic randomness interface recommended by the operating system or programming platform and check failures correctly.
Seeds, state, and repeats
A seed is input used to initialize or refresh a generator's internal state. A strong algorithm with a weak, guessable seed can still produce guessable output.
Bad seed ideas include:
- the current time by itself;
- a process identifier;
- a username;
- a counter;
- a hardcoded value; or
- the same saved state copied into many devices.
If two devices begin with identical generator state and receive no distinguishing entropy, they can produce the same “random” values. That has caused real systems to generate identical or mathematically related keys.
Hashing a weak seed does not repair the problem. A hash can mix input, but it cannot add uncertainty an attacker does not already have to search.
Strong bytes can still be sampled incorrectly
Suppose a CSPRNG gives one uniform byte, an integer from 0 through 255. An application wants a decimal digit from 0 through 9 and uses:
digit = byte mod 10
There are 256 byte values, but 256 is not divisible by 10. The digits 0 through 5 each receive 26 possible byte inputs, while 6 through 9 receive only 25. The source byte was uniform; the mapped digit is biased.
A common correction is rejection sampling:
- accept only byte values below 250;
- discard 250 through 255; and
- reduce the accepted byte modulo 10.
Now each digit has exactly 25 accepted byte inputs. The Bias Lab shows both distributions.
This example matters because security depends on the whole path. A strong source plus a small sampling bug can still create weak output.
Four failure patterns to recognize
1. Poor entropy
The seed contains fewer unknown possibilities than its size suggests. Time and process information may look complicated but can be guessed within a narrow range.
2. Repeated state
Two systems start from the same saved state and generate the same values. Cloned or newly booted devices are a classic risk.
3. Predictable generator
A general-purpose PRNG is used for tokens or keys. Its distribution may look fine, but observations reveal future values.
4. Biased sampling
Strong random bytes are converted into a smaller range incorrectly, making some outcomes more likely.
A practical decision check
Before accepting a generated value, ask:
- Purpose: Is it for security, simulation, testing, or presentation?
- Unpredictability: Would guessing the value help an attacker?
- Source: Does it come from a supported platform CSPRNG when security matters?
- State: Could a seed or snapshot be guessed, repeated, or copied?
- Sampling: Does conversion preserve the intended uniform distribution?
- Failure: Does the application stop safely if secure randomness is unavailable?
The shortest safe rule is:
If the value protects access, secrecy, identity, or freshness, use the platform's cryptographic randomness facility exactly as documented.
What to carry forward
Randomness is a property of a process and distribution, not a visual style. Entropy describes uncertainty. A PRNG expands state deterministically, while a CSPRNG adds security requirements that ordinary generators do not meet. Strong randomness must also be seeded, maintained, sampled, and checked correctly.
Keys and nonces will appear throughout the course. Whenever they do, ask where their uncertainty came from and whether an attacker can predict, repeat, or bias them.