Page History

...

On Windows platforms, the CryptGenRandom() function can be used to generate cryptographically strong random numbers. Note that the exact details of the implementation are unknown, including, for example, what source of entropy CryptGenRandom() uses. From the Microsoft Developer Network CryptGenRandom() reference [MSDN]:

If an application has access to a good random source, it can fill the pbBuffer buffer with some random data before calling CryptGenRandom(). The CSP [cryptographic service provider] then uses this data to further randomize its internal seed. It is acceptable to omit the step of initializing the pbBuffer buffer before calling CryptGenRandom().

...

Related Vulnerabilities

...

MITRE CWE: CWE-330, "Use of insufficiently random values"

Sources

[MSDN] "CryptGenRandom Function"

...