Advanced › Module 8 › Lesson 1
CSPRNG Named
CSPRNG literacy — OS RNG, getrandom, SecureRandom, weak RNG failure class — $CRYPTO_LAB toy demos only.
Visual · t28_csprng_named
CSPRNG = named randomness sources. $CRYPTO_LAB toys. Original Cyberlium.
Opening
Broken randomness breaks every crypto layer above it — name CSPRNG sources on YOUR lab toys, never harvest prod secrets.
CSPRNG literacy names: OS entropy sources (/dev/urandom, getrandom(), BCryptGenRandom, SecRandomCopyBytes), language APIs (secrets module Python, java.security.SecureRandom, crypto.getRandomValues JS), difference from Math.random and rand(), weak RNG failure class (predictable keys, repeated IVs, duplicated nonces). Analyst maps findings to 'use CSPRNG' fix — reads Module 3 weak RNG named attack class on $CRYPTO_LAB CTF only. Cyberlium teaches source selection and library calls — NOT seeding RNG with time() in production advice disguised as lab, NOT attacking prod HSM RNG, NOT predicting Linux kernel entropy on stranger systems. Lab row: four platform CSPRNG APIs with one NEVER use row (Math.random for keys).
1. Named CSPRNG sources
OS kernel RNG, platform API, language secure module — three layers literacy.
Nonces and IVs must come from CSPRNG — link Module 5 AES modes.
Command guide
Try these commands — Named CSPRNG sources
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
OpenSSL rand — https://www.openssl.org/docs/manmaster/man1/openssl-rand.html
NIST SP 800-57 — https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final (entropy requirements) CWE-330 — https://cwe.mitre.org/data/definitions/330.html (insufficient randomness)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows:
Command — copy this
choco install openssl
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
openssl rand -hex 32 | tee "$CRYPTO_LAB/keys/lab-random-32.hex"
chmod 600 "$CRYPTO_LAB/keys/lab-random-32.hex"
python3 -c "print('256-bit random hex — use CSPRNG (openssl rand) for keys/IVs, not math.random')"Primary tools to practice this lesson: openssl, python3. Reference sites: OpenSSL rand (https://www.openssl.org/docs/manmaster/man1/openssl-rand.html); NIST SP 800-57 (https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final); CWE-330 (https://cwe.mitre.org/data/definitions/330.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Weak RNG failure class
Predictable keys, repeated IVs, duplicated ECDSA k — named consequences on $CRYPTO_LAB toys.
Defender fix: library CSPRNG call — not custom LCG.
3. $CRYPTO_LAB boundary
Weak RNG demos on instructor CTF toys only — not prod oracle attacks.
Refused: Math.random key generation, prod entropy prediction, stranger HSM probing.
4. What you ship: CSPRNG literacy card
Four platform APIs + weak RNG failure + NEVER Math.random for keys line.
5. What you record before the next lesson
CSPRNG literacy card path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Generate AES keys with Math.random in 'production sample code.'
Right
CSPRNG literacy card from $CRYPTO_LAB notes. Next: Key Storage.
Mission: CSPRNG literacy card
1) Name four CSPRNG APIs. 2) One weak RNG failure example. 3) Link to library-not-DIY stub. 4) Write NEVER Math.random for keys.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Duplicated ECDSA k — why catastrophic?”
Knowledge Check
APPLY: CSPRNG literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Math.random is OK for cryptographic keys.
True or False
Knowledge Check
APPLY: Weak RNG can cause:
Multiple choice