Hacker News new | past | comments | ask | show | jobs | submit login

How does this compare to what you get from one of the csprngs in rust's rand crate? I'm not sure when I'd use this.

https://rust-random.github.io/book/guide-rngs.html#cryptogra...




There shouldn’t be much of a difference, although the rust crate is more similar to the OpenSSL part. Just make sure to properly seed your CSPRNG, e.g. via using Rust’s ThreadRng[1]. In basically all cases there is no reason to use anything from the rand crate except ThreadRng.

1: https://rust-random.github.io/rand/rand/rngs/struct.ThreadRn...


If you have to seed it, you're doing something wrong. You want to be using the system random number generator, the one the kernel provides, in preference to any userland RNG.


ThreadRng is what the GP recommended. From the linked page:

> ThreadRng is automatically seeded from OsRng with periodic reseeding (every 64 kiB, as well as “soon” after a fork on Unix — see ReseedingRng documentation for details).

Is the system's random number generator actually better than this? It looks like the rand developers know what they're doing, and using a library like this is attractive because I don't have to figure out the "right" random number API on different operating systems. (arc4random()? Is that only a macos thing? srandom()? random()? What is it on windows? Should I be reading from /dev/srandom or something? Etc.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: