Re: generate random numbers

On Tue, 03 May 2005 13:20:48 -0700, DA Morgan <damorgan_at_x.washington.edu> wrote:

>Vince <vincent@ wrote:
>
>> I would like to use random numbers in my pl/sql code..
>> do I really need to user dbms_random package or there is another to do
>> so ?
>> if so, how could I use dbms_random to generate positive random
>> numbers??
>
>Depends on the version of Oracle.
>
>DBMS_RANDOM isn't really. Which is why, with 10g, true random
>number generation was built into the DBMS_CRYPTO package.

 The docs for DBMS_CRYPTO don't claim true random number generation, they claim:

 "a cryptographically secure pseudo-random sequence of bytes, which can be used to generate random material for encryption keys. The RANDOMBYTES function is based on the RSA X9.31 PRNG (Pseudo-Random Number Generator), and it draws its entropy (seed) from the sqlnet.ora file parameter SQLNET.CRYPTO_SEED."

 This is certainly a /much/ stronger claim than DBMS_RANDOM makes, which is basically just a big warning saying "don't use for cryptography".

 You can't get true random number generation from a pseudo-random algorithm, you need some sort of truly random physical phenomenon to base it on, e.g. the thermal noise hardware RNG chips that Intel had in their chipsets for a brief time before they abandoned them.

 Unless Oracle now ships with a lump of radioactive material and a Geiger counter that provides true random data to DBMS_CRYPTO :-) It's just the difference between true randomness, or a pseudo-random series of numbers that is enormously difficult to predict and therefore for most purposes as good as a true random source.

-- 
Andy Hassall / <andy@andyh.co.uk> / <http://www.andyh.co.uk>
<http://www.andyhsoftware.co.uk/space> Space: disk usage analysis tool