What is the difference between a non-secure random

问题:

As the title says: What is the difference between a non-secure random number generator and a secure random number generator?

回答1:

No computationally feasible algorithm should:

• recover the seed, or
• predict the "next bit"

for a secure random number generator.

Example: a linear feedback shift register produces lots of random numbers out there, but given enough output, the seed can be discovered and all subsequent numbers predicted.

回答2:

A secure random number should not be predictable even given the list of previously generated random numbers. You'd typically use it for a key to an encryption routine, so you wouldn't want it guessable or predictable. Of course, guessable depends on the context, but you should assume the attacker knows all the things you know and might use to produce your random number.

There are various web sites that generate secure random numbers, one trusted one is hotbits. If you are only doing the random number generation as a one off activity, why not use a lottery draw result, since it's provably random. Of course, don't tell anyone which lottery and which draw, and put those numbers through a suitable mangle to get the range you want.

回答3:

With just a "random number" one usually means a pseudo random number. Because it's a pseudo random number it can be (easily) predicted by an attacker.

A secure random number is a random number from a truly random data source, ie. involving an entropy pool of some sorts.

回答4:

Agree with Purfiedeas. There is also nice article about that, called Cheat Online Poker

回答5:

A random number would probably mean a pseudo random number returned by an algorithm using a 'seed'.

A secure random number would be a true random number returned from a device such as a caesium based random number generator (which uses the decay rate of the caesium to return numbers). This is naturally occurring and can't be predicted.

回答6:

It probably depends on the context, but when you are comparing them like this, I'd say "random number" is a pseduo random number and a "secure random number" is truly random. The former gives you a number based on a seed and an algorithm, the other on some inherintly random function.

回答7:

It's like the difference between AES and ROT13.

To be less flippant, there is generally a tradeoff when generating random numbers between how hard it is and how predictable the next one in the sequence is once you've seen a few. A random number returned by your language's built-in rand() will usually be of the cheap, predictable variety.