Is std::random_device cryptographic secure?

Question

I see many people talk about security and std::random_device together.

For example, here slide 22.

According to cppreference, std::random_device :

std::random_device is a uniformly-distributed integer random number generator that produces non-deterministic random numbers.

It does not talk about security explicitly.

Is there any valid reference that explicitly mentions std::random_device is secure for cryptography?

Answer 1

No, because that's not what std::random_device is designed for; it's designed to generate random numbers, not to be secure.

In the context of security, randomness is something that is useful for key generation, but randomness is not something that is absolutely needed. For example, AES does not use any randomness, yet AES-256 is what is used to encrypt top secret information in the US.

One area where randomness and security cross, is when a random key is generated and used; if I can guess the seed and know the random protocol used, there's a good chance I can then use that same seed value to generate the same "random" value and thus the same key.

std::random_device will use a hardware module (like a hardware TPM) if one is available, otherwise it will use whatever the OS has as a RNG (like CryptGenRandom in Windows, or /dev/random in *nix systems), which might even be a PRNG (pseudo-random number generator), which might generate the same number depending on the random number algorithm used. As a side note: much like how the AES instruction set was incorporated into chipsets to speed up encryption and decryption, hardware RNG's help to give a larger entropy pool and faster random number generation as the algorithms are moved into hardware.

So if you are using std::random_device in any sort of cryptographic key generation, you'll need to be aware what random number generator is being used on the system being deployed to, otherwise you can have collisions and thus your encrypted system can be susceptible to duplicate key types of attack.

Hope that can help.