Lesson 1.13: Randomness and keys
Every key, salt, token and session ID is only as strong as the randomness it came from. Why ordinary random functions and timestamps are predictable, what a cryptographically secure random number generator (CSPRNG) is, where to get one on Linux and in PHP, and how key length relates to security. In the lab you notice that the shop's password-reset tokens are the MD5 of the time they were made, reproduce one from the log with one line of PHP, replace it with random_bytes, and compare with openssl rand.
17 min
You will learn to
- Explain why keys and tokens need unpredictable randomness
- Recognise predictable tokens (time, counters, rand())
- Use a CSPRNG: random_bytes in PHP, openssl rand
- Relate key length in bits to brute-force effort
- Fix a predictable token generator
Key terms
- CSPRNG
- A random number generator whose output can't be predicted even by someone who has seen earlier outputs.
- Entropy
- A measure of unpredictability, counted in bits. n bits of entropy means 2^n equally likely possibilities.
- Unix time
- Seconds since 1 January 1970 00:00:00 UTC.
- Token
- A random value that proves something: a password reset link, a session, an API access.
- Key length
- The size of a key in bits. Each extra bit doubles the brute-force effort.
← Requests, parameters, cookies and sessions · All lessons · Jobs in cybersecurity and your learning path →