Gah! I'm not a security expert, but I know enough that should I require some cryptographically strong random numbers, the last place I want to fetch them would be from some disinterested third party (even if I do have a couple of links on my homenode).
For really, really strong numbers, I would read from the blocking version of the kernel's entropy pool, /dev/random on BSD, /dev/urandom (I believe) on Linux, and EGD on Solaris (at least on the ancient 2.6 I'm using). For merely really strong numbers but high volume, I'd just use output from one of those to seed a good PRNG, such as the Mersenne Twister (for which a Perl module exists... hmm, no, two competing modules, Rand::MersenneTwister and Math::Random::MT). This PRNG has a 2**19937-1 period, and can be fed to a digest function to produce stronger bits, at a certain cost in speed.
The main point is that you can, and should, always generate them locally.
_____________________________________________
Come to YAPC::Europe 2003 in Paris, 23-25 July 2003.
In reply to Rex2 Cryptographic Random Numbers
by grinder
in thread Cryptographic Random Numbers
by John M. Dlugosz
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |