News for hackers. Stuff that matters.

A comment on There's Math.random(), and then there's Math.random(). Parent comment

Re:There's Math.random(), and then there's Math.random() by tomsmeding on Friday February 07, 2025 @03:03AM (#42970490)
In a class we had to reverse-engineer an application that had encrypted some text file — we had to decrypt it without the key. Turned out the application just used the current unix timestamp as the key. A brute-force search of the past few months didn't take very long.

If you include nanoseconds in your key then you have more entropy, of course, but timestamps are guessable, so it's risky.

[ Parent | on HN ]
Re:There's Math.random(), and then there's Math.random() by sverhagen on Friday February 07, 2025 @05:57AM (#42971300)
Those nanoseconds aren't really entropy then, are they?
[ Parent | on HN ]
Re:There's Math.random(), and then there's Math.random() by lmm on Friday February 07, 2025 @06:35AM (#42971499)
They're entropy for most practical purposes. But there's only 1000 possibilities, so that's less than 10 bits' worth.
[ Parent | on HN ]
Re:There's Math.random(), and then there's Math.random() by boothby on Friday February 07, 2025 @09:05AM (#42972636)
Especially if you're writing a file, the creation time is a big hint! Even nanoseconds won't help if you're leaking that many bits from your seed.
[ Parent | on HN ]
Re:There's Math.random(), and then there's Math.random() by tomsmeding on Friday February 07, 2025 @10:01AM (#42973367)
That's milliseconds; nanoseconds are 1e-9 seconds. Still, the file creation time remark of sibling is pertinent.
[ Parent | on HN ]
Re:There's Math.random(), and then there's Math.random() by lmm on Friday February 07, 2025 @08:04PM (#42979321)
I was thinking of the step from milli to nano, so yeah 1e6 not 1e3, 20 bits not 10. But the point stands.
[ Parent | on HN ]