Senior LevelWeb Security & Cyber Defense
Why are pseudo-random number generators (Math.random) dangerous for security and how do CSPRNGs work?
❓ Interview Prompt: Explain CSPRNG (Cryptographically Secure Pseudo-Random Number Generator), `crypto.getRandomValues()`, entropy sources, and PRNG predictability attacks.
Standard programming language random functions (e.g. 'Math.random()' in JS or 'rand()' in C) use deterministic PRNG algorithms (like LCG or xorshift128+):
Vulnerability:
PRNG algorithms are non-cryptographic. An attacker observing a small sequence of generated outputs can mathematically reconstruct the internal state and predict all future random numbers!
•
Defense: Use CSPRNGs ('crypto.getRandomValues()' or '/dev/urandom'), which harvest hardware entropy (thermal noise, interrupt timing) to guarantee unpredictable randomness.
Code Implementation Example
typescript
import crypto from 'crypto';
// ❌ VULNERABLE for security: Math.random() is predictable!
// const sessionToken = Math.random().toString(36);
// ✅ SECURE: CSPRNG (Cryptographically Secure Pseudo-Random Number Generator)
const secureToken = crypto.randomBytes(32).toString('hex');💡Generating cryptographically secure random bytes using CSPRNG in Node.js.
🎯 Interview Key Takeaway
Never use Math.random() for security tokens or keys; use CSPRNGs (crypto.randomBytes) backed by hardware entropy.
#CSPRNG#Randomness#Cryptography#Senior
Back to all Web Security & Cyber Defense Questions→