<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi,</p>
<p><br>
</p>
<p>I note the manual for rand_bytes() describes it as note cryptographically strong:</p>
<p><br>
</p>
<p><a class="OWAAutoLink" id="LPlnk452283" href="http://erlang.org/doc/man/crypto.html#rand_bytes-1">http://erlang.org/doc/man/crypto.html#rand_bytes-1</a></p>
<p><br>
</p>
<p><span><em>This function is not recommended for cryptographic purposes</em></span></p>
<p><br>
</p>
<p>Reviewing the manual for "strong rand bytes" however:</p>
<p><br>
</p>
<p><a class="OWAAutoLink" id="LPlnk303128" href="http://erlang.org/doc/man/crypto.html#strong_rand_bytes-1">http://erlang.org/doc/man/crypto.html#strong_rand_bytes-1</a></p>
<p><br>
</p>
<p><em>By default this is the <span class="code">RAND_bytes</span> method from OpenSSL.</em></p>
<p><br>
</p>
<p>This isn't necessarily a great solution either, with both Node and Ruby being advised against this:</p>
<p><br>
</p>
<p><a class="OWAAutoLink" id="LPlnk718714" href="https://bugs.ruby-lang.org/issues/9569">https://bugs.ruby-lang.org/issues/9569</a></p>
<p><br>
</p>
<p><a title="https://github.com/nodejs/node/issues/5798
Ctrl+Click or tap to follow the link" class="OWAAutoLink" id="LPlnk857059" href="https://github.com/nodejs/node/issues/5798">https://github.com/nodejs/node/issues/5798</a></p>
<p><br>
</p>
<p><br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> erlang-questions-bounces@erlang.org <erlang-questions-bounces@erlang.org> on behalf of Jesper Louis Andersen <jesper.louis.andersen@gmail.com><br>
<b>Sent:</b> Friday, 10 June 2016 2:46:45 AM<br>
<b>To:</b> duncan@sfractal.com<br>
<b>Cc:</b> Erlang (E-mail)<br>
<b>Subject:</b> Re: [erlang-questions] Random/Crypto Issue with Erlang?</font>
<div> </div>
</div>
<div>
<p dir="ltr">You probably want Kenji Rikitake. The thing is about CSPRNGs and using strong random bytes from crypto.</p>
<div class="gmail_quote">On Jun 9, 2016 4:06 PM, <<a href="mailto:duncan@sfractal.com">duncan@sfractal.com</a>> wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><span style="font-family:Verdana;color:#000;font-size:10pt">
<div>I believe one of the lightning talks at Erlang Factory SF 2016 was about an issue with randomness and crypto and something we shouldn't use and what we should do instead. Does this ring a bell? Can anyone point me to the do's and don't's that were mentioned?
Or who gave that talk so I can contact him?<br>
</div>
<div><br>
</div>
<div>Duncan Sparrell</div>
<div>s-Fractal Consulting LLC</div>
</span></div>
<br>
_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
<br>
</blockquote>
</div>
</div>
</body>
</html>