It is not cryptographically secure
Closed this issue · 5 comments
Being "cryptographically secure" means "learning of one/some produced elements doesn't give information about unlearned elements".
Random.new uses non-cryptographical generator with 127 bit state. Every produced uuid with this library exposes information about 123 bits of generator state. It means, knowledge of just one uuid allows to predict 4094/16=256 neighbour uuid with probability just 1/16. It is too large probability to claim "cryptographically secure".
Knowledge of two subsequent uuids exposes internal state completely.
Yes, it is not simple for regular user to revert output of PCG. But it will be trivial for specialist in cryptography.
That's true. Fixed
I've read that discussion. There were no single proof of "cryptographic security" of thus library.
Yup. I removed the "cryptographically secure" part from the README.
Ok!