Which statement best describes the approach to generating cryptographically secure random numbers in a TA?

• A. They are used for keys, nonces, and session identifiers
• B. They can be derived from predictable values
• C. They are not important for session identifiers
• D. They rely on CSPRNGs, proper entropy sources, hardware RNGs, and periodic validation

Answer: (D)

Generating cryptographically secure random numbers relies on a cryptographically secure PRNG that remains unpredictable even if part of its internal state is exposed. This requires seeding from high-quality entropy sources and ongoing protection of that entropy, often using hardware RNGs to refresh or seed the generator. Regular validation and reseeding help detect any bias, failure, or deterioration in the generator’s behavior, ensuring continued security over time.

Numbers used for keys, nonces, and session identifiers must come from such a secure setup; they should be unpredictable and not guessable by an attacker. Deriving randomness from predictable values is dangerous because it can allow attackers to reproduce or anticipate outputs. Also, session identifiers must be protected by unpredictability, not treated as unimportant.

That’s why the comprehensive approach—CSPRNGs backed by proper entropy sources, hardware RNGs when available, and periodic validation—best describes the recommended practice.