Search code examples
randomopensslcryptographycrypto++prng

Should the same Random Number Generator be used for multiple crypto operations


Is it recommendable to instantiate an OpenSSL or Crypto++ cryptographically secure random number generator, seed it once, and use it sequentially in multiple cryptographic operations like generating keys, encryption, signing etc.?

Will this be be secure enough to handle multiple uses without compromising the security?

Is it considered a safe practice to use different PRNGs for each operation and seed them differently? Are there any nuances that should be considered?


Solution

  • Stay with the same cryptographically secure PRNG. I know it seems to make more sense to change, but it is a big mistake to apply common sense when higher math is called for. Never "roll your own" crypto, or change the methods, or make any "improvements" no matter how much sense they seem to make. Stick with proven methods, tested algorithms, and open source code written by people with a good reputation.

    Cryptographically secure PRNGs are very different from the standard PRNGs used for things like Monte Carlo simulation. They are specifically designed to be unpredictable even when a long sequence of values is taken. If you try to "improve" on that by switching, you are more likely to screw it up.

    Also, good hardware true RNGs are cryptographically secure by their nature, so the best possible option if you have it is to use something like random.org.

    The worst you could possibly do is change PRNGs every key. Now you're not getting a random sequence at all, but a sequence which is a hash function of your seeds, and only as good as your seeds and the seeding function of each PRNG.