Hello,
What is the (best) way to create a secure random numbers in Linux (C/ C++ code), more random than the general rand() results, and not pseudo as OpenSSL BN_rand?
In Windows I found CryptGenRandom() as a good option. Is there any equivalent in Linux?
Thank you in advance.
you can read from /dev/random which is populated with an entropy pool. There is some good info on the wikipedia site on it: http://en.wikipedia.org/wiki//dev/random
"Random" numbers generated by a computer without any external data are pseudo-random. It means that they are generated with a mathematical formula. These algorithms are reliable and should be okay for almost all purposes.
To have a "true" random number, you need an intervention from outside. There are some solutions implemented in various programs (I remember of several ones that used mouse movements or atmospheric noise).
As Martijin just pointed, there is also /dev/random on Linux and OSX. It uses the noise collected by the device drivers.
There is also a web service that I just found : http://www.random.org/clients/http/
1st CryptGenRandom is not "truly" random device by they are enough random to be cryptographically safe.
Similar under Linux (and most unixes) is reading from /dev/urandom.
If you want to get real random numbers you may read /dev/random but you may get blocked waiting for system to collect them if entropy pool is too small.
/dev/urandom generates some random numbers based on the actions you perform(moving of the mouse,typing,etc!)