Question

I created a random generator for cryptography purposes I would like to know if it is secure enough. If it is you’re free to use it of course. Thanks in advance for reading my wall of text 😀

Explanation of functions

The $this->pref_hash_algo($bits_of_entropy=null, $inclusive=false) function gets the default hashing method (in my case sha256) or if $bits_of_entropy is given it gets the optimal hashing algorithm that is either inclusive or not. For instance 230 bits of entropy inclusive would return sha256 while exclusive would give sha224.

The algorithm returned from self::$HASH_PREFERENCES['128'][0] is ripemd128

For $this->hash($input, $algorithm=null, $output_type=self::OUTPUT_HEX) it only does a PHP hash($input, $algorithm[, $binary]) with extra checking if the algorithm is considered secure and support for more output types then binary and hexadecimal.

Generation code

For easy access moved first version to http://pastebin.com/YtJFvpah

Update

Based on your input I have altered the code to the following: http://pastebin.com/bQ5tFDdh

Summary of edits:

• Not hashing, but only formatting /dev/urandom output.
• Added meantime output hashing, for when hashing algorithm has too little output for the requested amount of random bits (for example sha512 when 4000 bits are requested)

Testing

Case 1

I ran php /my/path/to/file.php | ent to test the /dev/urandom method and the alternative method on a 2.000.000 byte sample.

• /dev/urandom gave 7.999903 bits per byte entropy. ( http://pastebin.com/NLqZ5Kza )
• Alternative method gave 7.99913 bits per byte entropy. ( http://pastebin.com/rnebrvKg )

Case 2

I created a 4,7MB binary file using the ALTERNATIVE METHOD (when /dev/urandom is disabled/not available) and ran dieharder -a -f /home/beanow/random.input -t 10:

• /dev/urandom gave: 2 weaks ( http://pastebin.com/HiwQeJtP )
• Alternative method gave: 0 weaks ( http://pastebin.com/x1VbEhzg )

Case 3

The same as case 2 but with 20MB binary files and removing the -t argument to use the default setting.

• /dev/urandom gave: 4 weaks ( http://pastebin.com/hwqQBTqu )
• Alternative method gave: 1 weak ( http://pastebin.com/cvPXiGBV )

Answer 1

There are a number of tests you can run against your output to determine how random it really is.

ent – A Pseudorandom Number Sequence Test Program

… [ent] applies various tests to sequences of bytes stored in files and reports the results of those tests. [ent] is useful for evaluating pseudorandom number generators for encryption and statistical sampling applications, compression algorithms, and other applications where the information density of a file is of interest.

The diehard test suite

… a battery of statistical tests for measuring the quality of a random number generator. Wikipedia

The dieharder test suite

The primary point of dieharder (like diehard before it) is to make it easy to time and test (pseudo)random number generators, both software and hardware, for a variety of purposes in research and cryptography.

Passing both the diehard and dieharder test suites is quite difficult with a home-grown pseudo-random number generator.