Is there a cryptographically secure alternative to arc4random on iOS?

Question

I'd like to use a PRNG like arc4random_uniform(); however, Wikipedia seems to think that rc4 is insecure. I don't have the wherewithal to confirm myself, but security is a requirement for my use-case.

Answer 1

arc4random_uniform is documented as a "cryptographic pseudo-random number generator," so it should be fine for this purpose. Do not confuse the security problems of RC4 with arc4random. See Zaph's answer for more details. (I've researched this before, and I remember arc4random being just as secure as other approaches, but I trust Zaph more than I trust my own memory.)

That said, if you are nervous, the tool you want to use is SecRandomCopyBytes (alternately you can read from /dev/random, which is exactly what SecRandomCopyBytes does by spec).

Getting a random value from SecRandomCopyBytes is harder than it should be, but not too hard. Here's how you do it in a highly generic way (Swift 3):

extension Integer {
    static func makeRandom() -> Self {
        var result: Self = 0
        withUnsafeMutablePointer(to: &result) { resultPtr in
            resultPtr.withMemoryRebound(to: UInt8.self, capacity: MemoryLayout<Self>.size) { bytePtr in
                SecRandomCopyBytes(nil, MemoryLayout<Self>.size, bytePtr)
            }
        }
        return result
    }
}

This works on any Integer. Basically we interpret a bunch of random bytes as an Integer. (BTW, this approach does not work nearly as well for floating point values. You can do it, but you'll discover that not all bit patterns are actually "numbers" in floating point. So it's a little more complicated.)

Now you want to get those values in a range without introducing bias. Just saying x % limit creates modulo bias. Don't do that. The correct way approach is to do what arc4random_uniform does. It's open source, so you can just go look at it. Applying the same approach in Swift looks like:

extension Int {
    static func makeRandom(betweenZeroAnd limit: Int) -> Int {
        assert(limit > 0)

        // Convert our range from [0, Int.max) to [Int.max % limit, Int.max)
        // This way, when we later % limit, there will be no bias
        let minValue = Int.max % limit

        var value = 0

        // Keep guessing until we're in the range.
        // In theory this could loop forever. It won't. A couple of times at worst
        // (mostly because we'll pick some negatives that we'll throw away)
        repeat {
            value = makeRandom()
        } while value < minValue

        return value % limit
    }
}

We can't build this on Integer because there's no .max property on Integer.

In Swift 4 this is all cleaned up with FixedWidthInteger, and we can make this more generic:

extension FixedWidthInteger {
    static func makeRandom() -> Self {
        var result: Self = 0
        withUnsafeMutablePointer(to: &result) { resultPtr in
            resultPtr.withMemoryRebound(to: UInt8.self, capacity: MemoryLayout<Self>.size) { bytePtr in
                SecRandomCopyBytes(nil, MemoryLayout<Self>.size, bytePtr)
            }
        }
        return result
    }

    static func makeRandom(betweenZeroAnd limit: Self) -> Self {
        assert(limit > 0)

        // Convert our range from [0, Int.max) to [Int.max % limit, Int.max)
        // This way, when we later % limit, there will be no bias
        let minValue = Self.max % limit

        var value: Self = 0

        // Keep guessing until we're in the range.
        // In theory this could loop forever. It won't. A couple of times at worst
        // (mostly because we'll pick some negatives that we'll throw away)
        repeat {
            value = makeRandom()
        } while value < minValue

        return value % limit
    }
}