03_Randomness — Randomness — where keys come from

Level: 201 · working knowledge

A key is only as unguessable as the process that made it, so this chapter comes before any cipher. It is also the chapter with the highest ratio of real-world breaks to page count: more keys have been recovered by predicting a random number generator than by attacking a cipher.

The distinction that does the work is not random versus not random. It is predictable given what an attacker can see — which is why the same generator can be perfectly good for a simulation and catastrophic for a key.

The pages

#	Page	The question it answers	Status
1	random is not secrets	Why is random in the standard library dangerous here, and secrets not?	planned

Every page above is a plan until its row says written; see ROADMAP.md.

The through-line

Ask what an observer of the output can compute. For a PRNG, the answer is eventually the whole future and past of the stream; for a CSPRNG it is nothing, and that is the entire difference.