Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Keith Thompson <kst-u@mib.org>
Newsgroups: comp.lang.c
Subject: Re: Learn "elusive" and "reprimand" using C!
Date: Fri, 09 Sep 2016 12:26:52 -0700
Organization: None to speak of
Lines: 46
Message-ID: <lnzing7u2r.fsf@kst-u.example.com>
References: <elusive-20160909182549@ram.dialup.fu-berlin.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Injection-Info: mx02.eternal-september.org; posting-host="945944de09706c9b4e29b53c9d2efdc2"; logging-data="14928"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1/cw89uIQsweeRW4p2iK9SW"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (gnu/linux)
Cancel-Lock: sha1:82eyARuXlhmQwdMGroueaTl368E= sha1:WSzwZQZaiZjD38RBKTOpbM4ci8k=
Xref: csiph.com comp.lang.c:93334

ram@zedat.fu-berlin.de (Stefan Ram) writes:
[...]

I haven't studied the entire program, but your use of srand() stands
out.

> /** @brief returns a random number from a measurement of some
> random process.
> @details The overall quality of randomness of this function is
> not specified. In the worst case it might always return the same
> number. */
> unsigned int entropy( void )
> { return( unsigned int )( time( 0 )* time( 0 ) + time( 0 ) ); }

If time_t is a signed type (as it commonly is, this could easily
overflow, causing undefined behavior.

All three calls to time(0) will very likely return the same value, so
calling it three times probably doesn't add any more entropy.

> int main( void )
> {
>   srand( entropy() * entropy() + entropy() );
>   srand( ( unsigned int )rand() * entropy() );
>   rand(); rand(); rand();

It looks like you're arbitrarily making multiple calls to srand()
and rand() with arbitrary arguments, in the hope of getting behavior
that's somehow "more random".

If the implementation of srand() and rand() works well, then calling
srand(time(0)) once, then calling rand() once for each random number
you need, should be sufficient.  If it doesn't work well, then no
amount of tweaking is going to squeeze high-quality pseudo-random
numbers out of it.

You might consider wrapping srand() and rand() in functions that
you can update if necessary to use some system-specific PRNG.

[...]

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"