Secure Random Number Generator

Now that Construct 2 includes multiplayer, will it include a secure random number generator?

RC4 would work. A mersenne twister would only work if used as a shrinking generator, otherwise after enough random numbers, the internal state of the generator could be guessed.

Hashing would also work.

One would still need to seed the random number generator, which could easily be done with a single request

EDIT: to a php script which would generate openssl random bytes or to even the random.org server

I'm just saying, a major criticism of PHP is that it is too easy to program with it and doesn't include many cryptographic functions, mainly outsourcing it to the OpenSSL library.

https://www.usenix.org/system/files/con ... nal218.pdf

[quote:1haaocnd]Mediawiki.

Mediawiki is a very popular wiki appli-cation used, among others, by Wikipedia. Mediawiki uses mt rand() in order to generate a new password when the user requests a password reset. In order to predict the generated password we use the seed recov- ery attack of section 4.3. The function f that we sam- ple is the one used to generate a CSRF token which is the following:

Outsourcing secure RNG plugins to third parties who may or may not be properly maintaining the plug-in is an issue.

Multiplayer is worthless without means of preventing players from cheating at certain types of games. In a turn based game, one might be able to predict the results of one's own actions or that of an enemy player, or the types of resources/points/cards a player would receive.

My points are salient.

While I don't think javascript can ever protect against Eve, the issues of dealing with Alice and Bob still exist.

I'm going to lean that a new randomizer is the responsibility of the game developer. Not the tool creator. I know where your coming from. I am designing a game with random loot tables, randomized dice. But I'd rather that not be in Ashley's hands. I would rather do it myself for my own security. I personally will use Random.org kind of way.

I'm going to lean that a new randomizer is the responsibility of the game developer. Not the tool creator. I know where your coming from. I am designing a game with random loot tables, randomized dice. But I'd rather that not be in Ashley's hands. I would rather do it myself for my own security. I personally will use Random.org kind of way.

Not really.

The way they market Construct 2 implies it would be their responsibility.

Besides, I somehow doubt that if someone can code a very good random number generator, they would be dependent on Construct 2's multiplayer interface or even dependent on Construct 2 at all.

And this does have an MIT license: http://davidbau.com/encode/seedrandom.js Only improvement one could make would be discarding the first 256 bytes, and discarding a random number every frame. And maybe getting a cryptographer to certify the code.

Besides, if a game becomes famous, it better be secure.

Should we be talking about securing a multiplayer game like with a cryptographically secure number random generator, as you might use for generating encryption keys?

Otherwise.. Random() works completely fine in game situations.. I've used and tested it profusely... how would it be used for cheating?

If a player is the position to require randomizer prediction security. They will have the team, talent or money to do so. As it is most people who use MP don't need an advanced randomizer to avoid prediction.

Though I agree that Scirra does tend to market C2 as a "We do it all for you" tool maker. However I think that's a mistake on their part and hurts them in the long run. But that's another discussion.

Random() can't be used for cheating. The concept is that by taking enuogh samples of results. They can produce preditictive results. Then they can create tools to exploit prediction.

This only really matters for cheating if you're writing a casino game, or some game where predicting the RNG gives a significant advantage. It's hardly the most important part of most action based multiplayer games that probably will be made using construct. If you're making a game where you need such security, and need to fully understand where the security holes in your software lie you should already have knowledge to implement a CSRNG simply with the api in javascript, and no one could guess how it worked if you were the only one running host machines.

The concept is that by taking enuogh samples of results. They can produce preditictive results. Then they can create tools to exploit prediction.

results of what? the game or passwords?

Seems like an incredible amount of work to cheat on an indie game... I say fine, let them at it, they can only make the game more popular. And if they somehow break it, put out an update to fix it.

I cannot be 100% sure, but I don t think clients can influence that much a number generated by the host itself, so I don t see .e point of a "secure random generation", nor what you actually mean by that.

hes talking about predicting the output based on past states since the mersenne twister used by random() is 100% predictable if you have enough of its past states.

http://www.cigital.com/papers/download/ ... mbling.php

This isn't something that matters for most games where the random generator will be difficult to predict anyway. "shuffling" the deck multiple times with unpredictable different seeds would introduce enough randomness to prevent something like this from being a problem anyway.

Since computers are deterministic, "genuinely random" data needs to come from outside the system. There are specialist hardware devices for this, or you could use a service like random.org, or you could just ask the user to wave their mouse around randomly and then use that as your data (which I've seen other apps do).

doesn't srand() get the runtime time and use that as a seed? I think that is plenty random enough, pseudo or not.

as someone mentioned - maybe if you are dealing with casino style games for actual money you might need "true" randomness. But I would think the majority (if not 99.99%) of the games created with C2 will be more than adequate with Random().

Believe it or not, I've actually tested C2's random function against some dice while I was in the design phase a while back. The game was only on paper at that point; I wanted to know how long it would take a player to collect item drops that were only dropped based on a random number range. The percentages were basically the same. I ran the test many times until I was comfortable with C2's randomness. Now I use it all the time without hesitation.

Since computers are deterministic, "genuinely random" data needs to come from outside the system. There are specialist hardware devices for this, or you could use a service like random.org, or you could just ask the user to wave their mouse around randomly and then use that as your data (which I've seen other apps do).

http://davidbau.com/archives/2010/01/30 ... lions.html

http://finalfantasy.wikia.com/wiki/Trea ... asy_XII%29

"Network Entropy Seeding

One option for quick robust entropy is to use an online source of random bits like random.org. Random.org provides a high-volume online stream of unpredictable bits that are derived from atmospheric noise detected by an array of radio receivers in Dublin and Copenhagen, all built and run by Trinity College professor Mads Haahr. His service will happily ship a few of these physically generated bits to you over https for free." <-- personally I prefer to use openssl_pseudo_random_bytes

You are largely correct. But seriously, RNG attacks do exist. Certainly for Pokemon, Final Fantasy, and other games with weak seeds.

If you are making a multiplayer game you know they'll be online, so you could look at using an API:

https://api.random.org/json-rpc/1/

If you are making a multiplayer game you know they'll be online, so you could look at using an API:

https://api.random.org/json-rpc/1/

Latency for random.org is on the order of 200 milliseconds