Collaborate Disseminate
The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what’s the actual difference? Looking at their code, in some cases these libraries actually make reference to the same underlying fu… Continue reading Is Python’s `secrets` module using the same code as the `random` module?
We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it
Step 1: Generate a random number using a good a CSPRNG (Cryptographically Secure Pseudorandom… Continue reading Generating tokens via PRNG and Hashing
Does a TPM replace the default device’s security, or add to it?
I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing.
If we take randomness as a example:
Does th… Continue reading Does a TPM replace the default device’s security, or add to it?
I’m looking at way to generate random numbers for cryptographic purposes. More specifically, I looked at the Linux /dev/urandom function, which is considered a real random number generator. There are others number generators such as the gl… Continue reading What is "environmental noise"?
Prime numbers are core in security.
I saw this question about Java’s probablePrime
and was wondering if that API/approach is indeed used for real production-ready security code or other approaches are preferred to ensure there is 0 possibi… Continue reading Is Java’s probablePrime used in production?
I tried to use crunch for this case but I just can get numbers like: 000000000000000041242
What I need is a number like: 56248343627437350491
I mean full numbers without thousands of zeros and I just mean thousands of zeros in front of the… Continue reading Generate Random 20 Digit-Integer Key [closed]
I’m in the process of setting up a local (i.e. offline and very limited) business, and I’m thinking of generating invoice IDs randomly to avoid the clients knowing that they’re customer number #00000001 (and because I prefer something like… Continue reading Randomly generating invoice IDs
A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I’ve come here to see if smarter people than I (us?) can shed some light.
In PHP, I feel the below is secure … Continue reading Is this method of 32 char hash generation secure enough for online-based attacks?
I know that PHP used the system implementation for its rand() function, which is usually a weak LCG or LFSR implementation. Did this change?
In case it still does, I am using Fedora 32.
PHP states in its documentation that rand() does not… Continue reading Did PHP’s rand() get better?
I work in security and I’ve seen modulus (modulo) used in many encoding and crypto algorithms. However, today, a friend of mine mentioned that using modulo like this:
unsigned long int result = some_CSPRNG_output % 556600;
“Limits the se… Continue reading What affect does modulus have on CSPRNG outputs?