Generating Random Numbers Securely in Objective-C

Question

Where can I find an industry-accepted secure pseudo-random number generator for Objective-C? Is there one built in to the OS X SDK?

My question is basically the same as this one, except that I'm looking for a secure PRNG.

EDIT:

Thanks everyone for the help. Here's a simple one-liner to implement the /dev/random method:

-(NSData *)getRandomBytes:(NSUInteger)length {
    return [[NSFileHandle fileHandleForReadingAtPath:@"/dev/random"] readDataOfLength:length];
}

score 6 · Accepted Answer · answered Feb 10 '12 at 21:08

6

Security.framework has a facility for doing this, called SecRandomCopyBytes(). Although it's really basically just copying from /dev/random.

answered Feb 10 '12 at 21:08

Lily Ballard

182,031
33
381
347

Is SecRandomCopyBytes [supported in OSX](http://stackoverflow.com/questions/6510638/encrypt-nsstring-using-aes-128-and-a-key)? – pepsi Feb 13 '12 at 14:55
Ah looks like SecRandomCopyBytes was [added in Lion](https://developer.apple.com/library/mac/#releasenotes/General/MacOSXLionAPIDiffs/Security.html). I'd like to support 10.6.. any alternatives? – pepsi Feb 13 '12 at 15:07
Hmm.. is [this](http://www.mail-archive.com/cryptography@metzdowd.com/msg00620.html) a problem? – pepsi Feb 13 '12 at 20:45
@pepsi: Not unless you're working for the NSA. It's Good Enough™ for everyone else to use. The `/dev/random` entropy pool is fed by a root-level daemon that collects timing information from the kernel, so unless you're running on a horribly broken system where that daemon isn't running, you should be fine. – Lily Ballard Feb 13 '12 at 20:49

score 4 · Answer 2 · edited May 23 '17 at 12:22

You can use

int SecRandomCopyBytes (
   SecRandomRef rnd,
   size_t count,
   uint8_t *bytes
);.

This function is available in Security/Security.h Framework. This function reads from /dev/random to obtain an array of cryptographically-secure random bytes.

/dev/random is a blocking interface that only returns as much random data as the system possesses at any particular time. Once the system runs out of randomness, no more can be fetched until more is generated (by listening to the user bang on the keyboard, or however the OS gathers true randomness). /dev/urandom is a non-blocking interface that always returns the requested amount of data, by using a pseudorandom generator even when true randomness is exhausted.OS X has both of these as well, however they both act like /dev/urandom does on Linux.

Random Numbers
random(4) Mac OS X Manual Page
How good is SecRandomCopyBytes?

Generating Random Numbers Securely in Objective-C

2 Answers2

Linked