"true" randomness
Carlos Konstanski <ckonstanski <at> pippiandcarlos.com>
2009-07-09 16:50:20 GMT
I have a need for better randomness. The situation: I have an
araneida web server. I use the following function to generate a
session id cookie:
(defun generate-sessionid ()
"Generates a unique, random string to use as the value in a
LISPSESSIONID cookie. The string is comprised of 16 octets in hex,
just like a PHP sessionid."
(let ((sessionid nil))
(dotimes (i 16)
(let ((octet (random 256)))
(if (< octet 16)
(setf octet (format nil "0~x" octet))
(setf octet (format nil "~x" octet)))
(setf sessionid (concatenate 'string sessionid octet))))
sessionid))
As one might expect, if I call this function x number of times, I
always get the same x session id strings because of how (random)
works. I have never used a language that had a true random number
generator. It is always an exercise left to the programmer. Even my
old Timex Sinclair 1000, which seeded the random number generator from
a 16 bit counter that was incrememted every time the display was
refreshed (60 times per second), exhibited very unrandom behavior. I
guess randomness is hard to achieve.
The problem occurs when the web server is restarted. When that
happens, it starts generating the same session ids all over again. If
someone has a browser open with a session id saved in it, and that
session id happens to correspond with a new user's session id, and the
new user is a superuser or admin, then the first user gets the new
user's privileges.
At the very least, I need a way to reseed (random) with some modicum
of randomness. If even one octet can be "derailed" in my 16-octet
loop, the entire session id string would be unique. Is there some way
to make a random-state that is suitably random? If I call
(make-random-state t), will I get a repeatable succession of
random-state objects, or will I get something at least slightly
random?
A really great random number algorithm would be tops. I'm thinking I
need to take the results of (random) and combine it with some other
unique data, like the current time. Is this the right approach?
Carlos Konstanski
------------------------------------------------------------------------------
Enter the BlackBerry Developer Challenge
This is your chance to win up to $100,000 in prizes! For a limited time,
vendors submitting new applications to BlackBerry App World(TM) will have
the opportunity to enter the BlackBerry Developer Challenge. See full prize
details at: http://p.sf.net/sfu/Challenge