Cryptography.IRandomNumberGenerator is not cryptographically strong

[Martin Zima]

From the documentation, IRandomNumberGenerator (in Spring.Cryptography) claims to be cryptographically strong. I am no cryptography expert, but from a quick glance at it's default implementation (TRandomNumberGenerator) I believe this is not only untrue, but also effectively broken.

Currently, it calls System.Randomize and then System.Math.RandomRange in a loop for every (!) byte array requested. Firstly, calling Randomize repeatedly (i.e. resetting the seed) usually does not make much sense for such PRNGs. Secondly, calling it with the default Delphi implementation causes the seed to be reset to a time seed. Not only this tends to be very deterministic, but with some implementations (e.g. GetTickCount) also very likely to return the same value if invoked multiple times in a row.

Apart from this, the System.Random* functions are not thread-safe, but that's just another side issue.

I would suggest either removing the note saying it's cryptographically safe and moving the class out of the Cryptography unit to prevent any potential misconceptions about it (and fixing the Randomize calls) or removing it completely (until there is a better implementation).**

[Stefan Glienke]

Removing milestone: Future version (automated comment)