|
Re^2: A better rand() for Win32
by Anonymous Monk on Jul 30, 2007 at 21:06 UTC
|
Math::Random::MT is good choice - it uses Win32 Crypto API
by using the Win32::API Module.
Then to get a seed you start this in your code:
use Math::Random::MT::Auto 'win32';
If you already have Math::Random::MT and Win32::API installed, use it.
This offers an quick alternative for users who don't have or
can't install Win32::API and Math::Random::MT and need
only to install CAPICOM.dll that uses the same Crypto API. | [reply] |
|
|
| [reply] |
Re^2: A better rand() for Win32
by ysth (Canon) on Jul 30, 2007 at 21:08 UTC
|
That smacks of a rhetorical question. (If it wasn't, please ignore the following.) Why do you think someone might want a short cut-and-paste solution over a CPAN module? (Look, another rhetorical question!) If you can come up with any answers, perhaps you might present them along with counter-arguments? | [reply] |
|
|
Actually no. It wasn't rhetorical. I did a search for capicom, found a download page, attempted to follow the Capicom Reference link to find out what it was about. But, being MS, I got a "Sorry, there was a vowel in the month so we decided to change the location of everything on our website again, but oh dear, we seem to have missed updating a link", page. So, as I don't know if there is some advantage, and the docs do not appear to be available, I thought I would ask.
And, in the event that the author was not familiar with Math::Random::MT, asking would bring that module to his attention also.
Why do you think someone might want a short cut-and-paste solution over a CPAN module?
If it were a simple C&P job, I might understand the motivation, but as you have to also download and install Capicom SDK, it doesn't seem any easier than installing the Math-Random PPD. Especially when it requires authentication which doesn't work for me, despite that I have all the appropriate Genuine Windows certificates of Authenticity, holograms, asset tags and product keys. Probably because I have configured my machine to disable a bunch of unnecessary services.
As for counter arguments. It's hard to know what to counter until I know what advantages it is meant to have? Hence another reason for asking. I'm not at all convinced that entropy-based RNGs, especially those that require callouts to third-party websites, (I've failed to find out if capicom is one of these?), are much more secure than long period PRNGs like the Mersenne Twister, but I'm open to education on that.
I am aware that it is necessary to seed the MT correctly in order to use it for cryptographic purposes, but that doesn't seem to be a consideration here.
Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
"Science is about questioning the status quo. Questioning authority".
In the absence of evidence, opinion is indistinguishable from prejudice.
| [reply] |
|
|
If you are still interested in capicom.dll, this download link might work for you: CAPICOM — Download the update
Since it is a security update, there is no "Genuine Windows" authentification needed. Or at least so it seems to me.
| [reply]
[d/l] |
|
|
|
|
|
|
Thanks for expanding on your comment. One of these days, I'm hoping somebody drops a real PRNG into the perl core for use on platforms where $Config{randbits} < 48 (msvcrt is 15 :( ).
| [reply] |
|
|
Re^2: A better rand() for Win32
by bart (Canon) on Jul 31, 2007 at 20:44 UTC
|
If you look at the paper describing the Mersenne Twister, one of the first sentences you can read in the FAQ is:
Mersenne Twister is not cryptographically secure.
Since this post here specifically mentions suitability for cryptographic purposes, at least, in its categorization, it should immediately be clear what its alleged advantage over Math::Random::MT is. | [reply] |
|
|
Since this post here specifically mentions suitability for cryptographic purposes
Read again.
The only mention of 'cryptography' is the bland statement: " Cryptographically generated random numbers gather entropy to seed there generators." which is, by no reading that I can ascribe, the same as "suitability for cryptographic purposes".
And, it might serve your purpose better to read an entire thread before going off half cocked.
Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
"Science is about questioning the status quo. Questioning authority".
In the absence of evidence, opinion is indistinguishable from prejudice.
| [reply] |
|
|
He says "cryptographically secure random number generator". How can I be misreading that?
| [reply] |
|
|
|
|
|
