UNDERSTANDING RANDOMNESS IN COMPUTING: TRUE AND PSEUDO- RANDOM NUMBER GENERATORS

Аннотация

Random number generation (RNG) plays a foundational role in security, cryptography, and system design. Operating systems today implement complex mechanisms for generating random numbers securely. This survey paper presents an overview of RNG techniques used in major operating systems, including Microsoft Windows, Linux, and macOS. We examine entropy sources, deterministic random bit generators (DRBGs), system APIs, and quality testing mechanisms. The survey highlights key differences between OS-level RNG designs and emphasizes best practices, challenges, and potential vulnerabilities. This work aims to serve as a reference for students, developers, and security professionals seeking a comparative understanding of secure randomness in computing environments. Keywords: Random Number Generation, Operating Systems, Entropy, DRBG, Cryptography, RNG APIs, Windows, Linux, macOS. 1. Introduction Random number generation plays a pivotal role across numerous domains in computing, such as simulations, gaming applications, probabilistic algorithms, and—most importantly— cryptographic and security systems. In these areas, randomness goes beyond simple variation; it forms the very foundation of unpredictability, which is essential to the strength and reliability of cryptographic mechanisms. The effectiveness of secure cryptographic infrastructures heavily depends on the availability of high-entropy random numbers to maintain data confidentiality, safeguard integrity, and prevent adversaries from deducing or replicating sensitive values [1]. The phrase “security depends on randomness” aptly captures the essence of modern cryptography, where resilience to analysis and guessing is a fundamental requirement [2]. Key components include:  Encryption Keys: These are derived from random data to ensure uniqueness and unpredictability. If keys can be anticipated, the secrecy of encrypted messages is jeopardized.  Nonces (Numbers Used Once): These ensure that each encryption operation is distinct. If reused or generated predictably, nonces can open the door to replay attacks or breach the consistency of communication.  Salts: Random values appended to passwords prior to hashing, salts defend against precomputed hash attacks, such as those utilizing rainbow tables. Their absence allows attackers to leverage known hash dictionaries to crack passwords.  Secure Tokens: Employed in scenarios like session tracking or password recovery, tokens must be generated with strong entropy to avoid unauthorized access or token forgery. 105 When randomness is insufficient or flawed, security collapses—often with severe real- world consequences. Attackers may successfully guess keys, recreate secure tokens, or impersonate users within encrypted sessions [3]. Thus, incorporating robust and unpredictable random number generators (RNGs) into secure system design is not optional—it's imperative. Various widely used security protocols rely on high-quality random numbers, including:  TLS (Transport Layer Security), which encrypts web communications (e.g., HTTPS),  VPNs (Virtual Private Networks), which protect internet traffic,  Digital Signature mechanisms, which authenticate and preserve data integrity. These protocols utilize randomness during crucial steps such as key exchanges, session initialization, and digital signing. For example, during the TLS handshake, random values exchanged between client and server are essential for securely deriving session keys. If an attacker could predict these values, encrypted communications could be compromised. To support these cryptographic needs, modern operating systems—such as Windows, Linux, and macOS—embed RNG subsystems into their core architecture. These RNGs accumulate entropy from a wide range of unpredictable system-level sources, including:  User interactions (e.g., mouse movement, keyboard activity),  Timing discrepancies in hardware behavior (e.g., hard drive access, network packet timing),  Hardware-based noise sources (e.g., Intel's RDRAND, Trusted Platform Modules). This raw entropy is then processed by secure algorithms—such as AES in Counter mode, SHA family constructions, or ChaCha20—to expand it into long streams of cryptographically strong pseudorandom bits. To facilitate widespread and error-free usage, operating systems expose standardized APIs that allow applications and developers to retrieve random values without needing to implement their own potentially insecure methods [4]. Examples include Windows’ BCryptGenRandom from the Cryptography API: Next Generation (CNG), Linux’s /dev/random, /dev/urandom, and getrandom() system call, as well as macOS’s arc4random() and SecRandomCopyBytes() functions. Although the ultimate purpose—providing secure, high-quality randomness—is shared across platforms, their internal architectures and cryptographic approaches differ based on:  Platform-Specific Architectures: Windows employs the CNG framework, Linux uses character devices and syscalls,