Implementation details on RandomNumberGenerator class

Question

Hello,

In reference to the .NET Framework library to generate safe random numbers using the RandomNumberGenerator class, sample code:

RandomNumberGenerator rng = RandomNumberGenerator.Create();
byte[] random = new byte[32];
rng.GetBytes(random);

(The generated numbers can be 32 bytes and 16 bytes long respectively.)

Question:
Using the above code, are the 2 following requirements met?

1. non-deterministic algorithm
2. minimum entropy of 128 bits

Additional questions (if possible):

1. What is the minimum time that must elapse between calls to RandomNumberGenerator.GetBytes() to ensure the required level of entropy of 128 bits?
2. Is there any risk of “repetition” or entropy degradation if calls are made very close together?
3. What are the minimum versions of the .NET Framework that support the RandomNumberGenerator reliably to ensure 128 bits of entropy?
4. What versions of Microsoft Windows fully support the features required for the RandomNumberGenerator to ensure this entropy?

Thanks,

Francesco

Answer 1

Hi @Francesco Ghiselli , Welcome to Microsoft Q&A,

The RandomNumberGenerator class in the .NET Framework is based on cryptographically secure random number generation, which is non-deterministic. This means that the sequence of numbers produced by the generator is unpredictable and does not follow an established pattern, thus meeting the requirements of a non-deterministic algorithm.

Entropy is a measure of randomness. 128 bits of entropy is usually achieved by ensuring that the generated random numbers have 128 bits of randomness. In your example:

RandomNumberGenerator rng = RandomNumberGenerator.Create();

byte[] random = new byte[32];

rng.GetBytes(random);

You are generating 32 bytes (256 bits) of random data. Even if you only need 16 bytes (128 bits), using RandomNumberGenerator guarantees enough entropy because it is designed for cryptographic use and provides high entropy. Therefore, the requirement of a minimum entropy of 128 bits is indeed met.

RandomNumberGenerator in .NET is designed to provide high entropy regardless of the time between calls. There is no specified minimum time that must elapse between calls to GetBytes() to ensure 128 bits of entropy. The generator is designed to provide cryptographically secure random numbers even when called in rapid succession.

RandomNumberGenerator is designed for cryptographic applications, so the risk of duplication or entropy degradation is extremely low. The internal state and mechanisms used in RandomNumberGenerator to generate randomness are designed to avoid duplication and maintain high entropy even with consecutive calls.

RandomNumberGenerator class is available starting with .NET Framework 1.1. However, for reliable and secure generation of cryptographic random numbers, it is recommended to use at least .NET Framework 4.5 or later. This version includes improvements and better support for cryptographic functionality.

RandomNumberGenerator class relies on the underlying cryptographic API provided by the operating system. The class is fully supported on Windows XP SP3 and later. - For better security and support, it is recommended to use at least Windows 7 or later, as these versions have more modern and secure cryptographic implementations Best Regards,

Jiale

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.