Lesson plan

CryptGenRandom

CryptGenRandom is a cryptographically secure pseudorandom number generator function that is included in Microsoft CryptoAPI. In Win32 programs, Microsoft recommended its use anywhere random number generation is needed (it has since been replaced by BCryptGenRandom, see below). The kernel32 equivalent is RtlGenRandom. A 2007 paper from Hebrew University suggested security problems in the Windows 2000 implementation of CryptGenRandom (assuming the attacker has control of the machine). Microsoft later acknowledged that the same problems exist in Windows XP, but not in Vista. Microsoft released a fix for the bug with Windows XP Service Pack 3 in mid-2008. CryptGenRandom is deprecated as it belongs to the deprecated Windows CryptoAPI. The modern Cryptography API: Next Generation (CNG) replacement is BCryptGenRandom (and the underlying functions ProcessPrng and SystemPrng).

Back to article

Article summary

CryptGenRandom is a cryptographically secure pseudorandom number generator function that is included in Microsoft CryptoAPI. In Win32 programs, Microsoft recommended its use anywhere random number generation is needed (it has since been replaced by BCryptGenRandom, see below). The kernel32 equivalent is RtlGenRandom. A 2007 paper from Hebrew University suggested security problems in the Windows 2000 implementation of CryptGenRandom (assuming the attacker has control of the machine). Microsoft later acknowledged that the same problems exist in Windows XP, but not in Vista. Microsoft released a fix for the bug with Windows XP Service Pack 3 in mid-2008. CryptGenRandom is deprecated as it belongs to the deprecated Windows CryptoAPI. The modern Cryptography API: Next Generation (CNG) replacement is BCryptGenRandom (and the underlying functions ProcessPrng and SystemPrng).

Key claims

  1. publication date: 2007 — source: Wikipedia · confidence 0.95
  2. release date: 2008 — source: Wikipedia · confidence 0.95

Discussion questions

  1. Summarise the article in your own words. Which single claim would you verify first, and why?
  2. The record states that the publication date is "2007". What evidence would count against this claim?
  3. The record states that the release date is "2008". What evidence would count against this claim?
  4. Which claim in this article is most likely to be revised as the sources update? How would you check its current status?
  5. If two sources disagreed about one of these facts, what would you need in order to trust one over the other?

Bibliography

  1. Wikipedia https://en.wikipedia.org/w/index.php?oldid=1362684736

Key claims and bibliography are generated from the same tracked claims and sources as the article page.