Locked learning resources

Join us and get access to thousands of tutorials and a community of expert Pythonistas.

Unlock This Lesson

Locked learning resources

This lesson is for members only. Join us and get access to thousands of tutorials and a community of expert Pythonistas.

Unlock This Lesson

Why Security Needs Randomness

Jackie Wilson
Generating Random Data in Python Jackie Wilson 06:58
Recommended Tutorial Ask a Question

Welcome to video 3 of Generating Random Data in Python. In the last video, you saw how Python and NumPy’s random modules could prove useful in simulation and modeling. They are known as pseudo random number generators.

This same feature, however, makes them poor candidates for security.

How does randomness help us secure data? The short answer is that it helps us hide it. If you think about the children’s game hide and seek, to the seeker, the other children have chosen seemingly random places to hide.

In a similar way, random numbers can help us hide data using encryption. Encryption is used to secure data in transit, such as on a network, or at rest, such as on an encrypted hard drive.

Encryption uses an algorithm along with a key to sort of scramble the original data. The key is oftentimes randomly generated.

While there are many examples of encryption in computing, we’ll use the example of a secure web transaction, which involves both symmetric and asymmetric cryptography:

  1. In symmetric key cryptography, the sender uses a key to encrypt data, and the receiver uses that same key to decrypt data.
  2. In asymmetric key cryptography the sender and receiver use different keys, but I’we’ll cover that a little later.

Locked learning resources

Join us and get access to thousands of tutorials and a community of expert Pythonistas.

Unlock This Lesson

Already a member? Sign-In

Locked learning resources

The full lesson is for members only. Join us and get access to thousands of tutorials and a community of expert Pythonistas.

Unlock This Lesson

Already a member? Sign-In

00:00 Welcome to the third video on Generating Random Data in Python. In the last video, you saw how Python and NumPy’s random modules could prove useful in simulation and modeling, and they’re known as pseudo-random number generators.

00:14 This same benefit and feature, however, makes them poor candidates for security. So, how does randomness help us secure data? The short answer is it helps us hide it.

00:26 If you think about the children’s game hide and seek, to the seeker, the other children have chosen seemingly random places to hide, making the seeker’s job difficult. In a similar way, random numbers can help us hide data using encryption. Encryption is used to secure data in transit, such as on a network, or at rest, such as on an encrypted hard drive.

00:48 Encryption uses both an algorithm and a key to obscure the data, and it’s this key that is oftentimes randomly generated. While there are many examples of encryption in computing, I’ll pick the example of a secure web transaction, which involves both symmetric and asymmetric cryptography. In symmetric key cryptography, the sender uses a key to encrypt the data and the receiver has to use the same key to decrypt it.

01:17 In asymmetric key cryptography, the sender and receiver use different keys, but I’ll cover that a little later. Here is where I’m going to proceed with a very basic analogy, so if you are familiar with cryptography’s role in computing, you might consider skipping this next part.

01:33 This example is going to be very elementary, but let’s say the data you need to secure is simply the number 2. The encryption key you’ll use to encrypt the data is the number 3.

01:45 Your encryption algorithm, let’s say, is simple addition.

01:49 We apply the algorithm and the key, and our encrypted result is the number 5.

01:55 The receiver, to decrypt the 5, needs to know two things—the algorithm you used for the encryption and the encryption key. Without knowing those two things, the receiver cannot make any sense out of the number 5 and has no way to know the original data. In the real world, it’s typical to know the encryption algorithms, which are widely known, but the key needs to be kept secure. So in this basic analogy, the receiver and possible attackers would already know subtraction will decrypt the data, but only the receiver should know the number 3 as the missing piece. By knowing the key is 3, the receiver can deduce the original data as being 2.

02:39 So, given that very simple explanation, why is randomness important? Because the choice of 3 was deliberate. Well, let’s say you want to complete a secure transaction on the web with ABC company.

02:52 To scramble your communication, you need to share a secret random encryption key, similar to that number 3, but just known between the two of you.

03:01 This will keep your traffic safe.

03:04 You can see the conundrum that presents itself. How do you establish and share that key without it being exposed? This is where asymmetric cryptography comes in.

03:14 Asymmetric cryptography algorithms are able to generate key pairs where one key encrypts while the other decrypts. The same key cannot be used to do both—they can only operate as a pair.

03:27 One is considered public and one is considered private. In public key infrastructure, or PKI for short, ABC company would generate a pair of keys and keep one key private and secret while providing the world with the other key.

03:43 A certificate authority, or CA, would be like a notary to say, “Yup, this is genuinely ABC’s public key.” This is how the public keys work. If you want to encrypt data for only ABC company to see, you encrypt it with ABC’s public key.

04:00 Then only ABC can decrypt that data because they hold the only key that can do so—the companion private key. And this is how you can share a random symmetric key for the rest of the session. Likewise, in the reverse situation, if ABC wanted to make a statement or digital commitment publicly, they could encrypt the digital contract with their private key.

04:25 The fact that anyone in the world can use ABC’s public key to decrypt that means ABC is the true originator of that data. This, along with hashing, facilitates digital signatures.

04:38 As mentioned earlier, secure web transactions are just one application of encryption. Randomness is also important in establishing secure wireless communication, generating NASes, one-time pads, et cetera.

04:51 For a random number to be useful in security, it needs to be what we call cryptographically secure. The two factors that give a random number this distinction are entropy and size.

05:03 Entropy is basically a factor in the seed that is based on some external randomness that can’t be easily guessed, such as system state, and nature is often an excellent source for entropy.

05:14 The size of the random number needs to be sufficiently large that an attacker could not easily deduce the pattern.

05:21 Let’s look at another simplified example.

05:25 Data are stored and transmitted as bits. Let’s say I want to encrypt the letter 'h'. To keep things simple, let’s use its ASCII equivalent. A repeating encryption key then would have to be a 0 or a 1. In real life, my encryption algorithm would be much more complex, but to keep it simple, let’s say it’s the XOR, or the exclusive or operation. A 0 would produce the original data, and a 1 would produce the mirror image.

05:52 Obviously, with one bit, there is no encryption. If we increase the key to eight bits, or one byte, our keys would be any value ranging from 0 to 255. If we picked the key, say, 85 in binary, we’d get a slightly more difficult encryption to crack, but it would only take a max of 256 iterations to figure out what it was.

06:14 You can see where this is going.

06:16 It turns out, if we have 32 bytes of entropy for our key, we’re cryptographically secure. That’s 2 to the 256th number of bits, which is a 70-some-digit number in decimal.

06:28 That number of iterations in a reasonable amount of time is out of reach for most computers today. We’ve established that the random module as a PRNG is not cryptographically secure.

06:40 What we need is a cryptographically secure pseudo-random number generator, or CSPRNG. So, how do we achieve the necessary 32 bytes of entropy using Python?

06:54 The answers are coming up in the next video. See you there.

Become a Member to join the conversation.