On Monday, 27 February 2017 at 00:10:31 UTC, cym13 wrote:
The only thing that saves you here is that your DefaultCryptoRand isn't seedable. Note that I'm not saying that to bash you or anything, it just happens to show well why I think my article was necessary.
Oh, don't get me wrong, I'm very much in favor of your article, ESPECIALLY if people are using the phobos rng in security contexts.
Keep in mind though, if my Hash_DRBG implementation were seedable, it wouldn't be a valid implementation of Hash_DRBG anyway. (A good example, I think, of why we coders shouldn't be inventing crypto algorithms, only implementing establised ones created and well-studied by the math/crypto experts.)
