Question

Is there a simple Windows equivalent for this bash command:

head -c 500 /dev/urandom | tr -dc abcdefghijklmnopqrstuvwxyz | head -c 9; echo

I think the main problem is /dev/urandom, since I’ve heard of the CryptoAPI, but I don’t know if that’s cryptographically secure enough.

EDIT: Sorry, the code is used in a php script, and the %s represents a string substitution; I forgot to make that substitution when I asked the question. Fixed.

Answer 1

Taken from RFC 4086:

7.1.3. Windows CryptGenRandom

Microsoft’s recommendation to users of the widely deployed Windows
operating system is generally to use the CryptGenRandom pseudo-random
number generation call with the CryptAPI cryptographic service
provider. This takes a handle to a cryptographic service provider
library, a pointer to a buffer by which the caller can provide
entropy and into which the generated pseudo-randomness is returned,
and an indication of how many octets of randomness are desired.

The Windows CryptAPI cryptographic service provider stores a seed
state variable with every user. When CryptGenRandom is called, this
is combined with any randomness provided in the call and with various
system and user data such as the process ID, thread ID, system clock,
system time, system counter, memory status, free disk clusters, and
hashed user environment block. This data is all fed to SHA-1, and
the output is used to seed an RC4 key stream. That key stream is
used to produce the pseudo-random data requested and to update the
user’s seed state variable.

Users of Windows “.NET” will probably find it easier to use the
RNGCryptoServiceProvider.GetBytes method interface.