Is this a good way to generate a random string on iPhone?

Question

Here's the code I came up with:

NSString *randomString = @"";
for (int x=0;x<NUMBER_OF_CHARS;x++) {
  randomString = [randomString stringByAppendingFormat:@"%c", (char)(65 + (arc4random() % 25))];
}
return randomString;

EDIT:

To answer the comments:

1) I'm mostly concerned with brevity of code.

2) I also wonder if this is secure against guessing the string, and/or proof against collisions, if NUMBER_OF_CHARS is a high number (say 40) - not for this application, but in other cases.

3) Also, is there is a faster way if I want to make a ton of strings some day? This seems like it will be slow, since it makes an object each time through the loop.

Only you can answer if it is generating the kind of random string you are looking for. Unless there is something specific you are unsure of? — fbrereto, Apr 20 '12 at 19:07
What makes you question it? Are you getting output that you don't like? Are you concerned about performance? Please be more specific. — jscs, Apr 20 '12 at 19:07
As far as the code style goes, I would use `'A'` instead of 65. — Sergey Kalinichenko, Apr 20 '12 at 19:08
Maybe this would be a better place for this question: http://codereview.stackexchange.com/ — vikingosegundo, Apr 20 '12 at 19:13
Use `-[NSMutableString appendFormat:]` and return a copy to avoid creating `NUMBER_OF_CHARS` instances of `NSString` — hypercrypt, Apr 20 '12 at 19:21

score 9 · Accepted Answer · edited May 23 '17 at 12:22

9

If NUMBER_OF_CHARS is compile-time constant, you can speed up your code by avoiding repeated object creation. You can make your program shorter by one line, too:

char data[NUMBER_OF_CHARS];
for (int x=0;x<NUMBER_OF_CHARS;data[x++] = (char)('A' + (arc4random_uniform(26))));
return [[NSString alloc] initWithBytes:data length:NUMBER_OF_CHARS encoding:NSUTF8StringEncoding];

As far as I know, arc4random_uniform should be good enough for cryptographic applications, but you may need to consult a cryptography expert if the data that you are planning to protect is of high value to you or especially to your clients.

EDIT : Edited in response to nielsbot's comment.

edited May 23 '17 at 12:22

Community

1
1

answered Apr 20 '12 at 19:21

Sergey Kalinichenko

714,442
84
1,110
1,523

3

Technically, this will suffer from modulo bias. cf. http://stackoverflow.com/a/6194148/210171 – nielsbot Apr 20 '12 at 19:33
Oh, I marked this correct, but now I'm intrigued by the comment and unsure. – Andrew Johnson Apr 20 '12 at 19:35
@nielsbot Thanks for the note, it's nice to know about the modulo bias! I edited the answer to reflect that (and learned something new for myself in the process, which is always nice). Thanks! – Sergey Kalinichenko Apr 20 '12 at 19:37
1

@AndrewJohnson @dasblinkenlight's original solution works, but it's more correct to use `arc4random_uniform()` – nielsbot Apr 20 '12 at 19:39
Marked as correct, really enjoyed hearing from everyone on this, thanks! – Andrew Johnson Apr 20 '12 at 19:41

score 4 · Answer 2 · answered Apr 20 '12 at 22:58

FWIW, I'd favor Vincent Gable's suggestion of using a UUID. If you are set on the suggested algorithms, you can get a little bit more variance by using something like this variant of nielsbot's code (just replace the string of characters with whatever you want to include as part of your random strings)...

const NSUInteger NUMBER_OF_CHARS = 40 ;
NSString * CreateRandomString()
{
    static char const possibleChars[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
    unichar characters[NUMBER_OF_CHARS];
    for( int index=0; index < NUMBER_OF_CHARS; ++index )
    {
        characters[ index ] = possibleChars[arc4random_uniform(sizeof(possibleChars)-1)];
    }

    return [ NSString stringWithCharacters:characters length:NUMBER_OF_CHARS ] ;
}

score 2 · Answer 3 · edited May 23 '17 at 12:22

2

You might also consider using a UUID, since they're pretty well studied and widely used. I would probably start there before trying to guarantee the probability of collisions in my hand-rolled solution.

edited May 23 '17 at 12:22

Community

1
1

answered Apr 20 '12 at 21:35

Vincent Gable

3,455
23
26

1

Apple's documentation states that CFUUID and its NS brethren both generate UUIDs using MAC/timestamps. In many cases (for example, nonces) this is not what you'd want. I know of no really easy (read: without writing code/using 3rd party) way to generate version 4 (i.e. the random) UUIDs in Objective C. – Manav Sep 11 '12 at 08:51

score 0 · Answer 4 · answered Apr 20 '12 at 19:53

Here's a fast way to do this, if you will be doing this a lot

const NSUInteger NUMBER_OF_CHARS = 40 ;

NSString * CreateRandomString()
{
    unichar characters[NUMBER_OF_CHARS];
    for( int index=0; index < NUMBER_OF_CHARS; ++index )
    {
        characters[ index ] = 'A' + arc4random_uniform(26) ;
    }

    return [ NSString stringWithCharacters:characters length:NUMBER_OF_CHARS ] ;
}

score 0 · Answer 5 · answered Sep 11 '12 at 09:03

Another variant to the existing answers. I am posting this because it (seems) to be better performance wise, as it makes a single call to the ARC4 API.

NSString *random32CharacterString() {
    static const int N = 32; // must be even

    uint8_t buf[N/2];
    char sbuf[N];
    arc4random_buf(buf, N/2);
    for (int i = 0; i < N/2; i += 1) {
        sprintf (sbuf + (i*2), "%02X", buf[i]);
    }    
    return [[NSString alloc] initWithBytes:sbuf length:N encoding:NSASCIIStringEncoding];
}

Is this a good way to generate a random string on iPhone?

5 Answers5