CryptGenRandom output not getting same as rand() call - c++

Question

I tried to create random number using CryptGenRandom() call for avoiding cryptographic attack.
I tried to run follwing code which prints both rand call and CryptGenRandom() call.
HCRYPTPROV hProvider = 0;
const DWORD dwLength = 5;
BYTE pbBuffer[dwLength] = {};
if (!::CryptAcquireContext(&hProvider, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT|CRYPT_SILENT))
return 1;
srand((unsigned)time (0));
for(int i=0; i<10; ++i)
cout<<"rand()::"<<i<<":"<<rand()<<endl;
for (DWORD i = 0; i < dwLength; ++i)
{
if (!::CryptGenRandom(hProvider, dwLength, pbBuffer))
{
::CryptReleaseContext(hProvider, 0);
return 1;
}
std::cout << "windows::"<<i<<"::"<<static_cast<unsigned int>(pbBuffer[0])<< std::endl;
}
if (!::CryptReleaseContext(hProvider, 0))
return 1;
but output of this getting for rand() call is
rand()::0:9754
rand()::1:526
rand()::2:29162
rand()::3:10461
rand()::4:31585
rand()::5:15594
rand()::6:12157
rand()::7:19178
rand()::8:5413
rand()::9:16157
and CryptGenRandom() call is giving
windows::0::167
windows::1::138
windows::2::197
windows::3::101
windows::4::44
Can anyone help me to get same output which is giving rand() call using CryptGenRandom?
CryptGenRandom() is giving only 3 digit random numbers which not sufficient for setting values for sleep calls which I am using in my code.

Answer 1

The problem is your use of pBuffer[0] here.
static_cast<unsigned int>(pbBuffer[0])
As your code shows, pBuffer[0] is a single BYTE. That's why you're not getting values greater than 255.
If you want any representable unsigned int, you'll want this.
const DWORD dwLength = sizeof(unsigned int);
And this, to use all the bytes in pBuffer.
*static_cast<unsigned int*>(pbBuffer)

Answer 2

Uhm, it's only giving 3 digit numbers because you are taking only one byte and converting it to an unsigned int when you do this: static_cast<unsigned int>(pbBuffer[0]) and a BYTE (i.e. an unsigned char) can only fit values between 0 and 255.
You can change your approach slightly:
unsigned int MyGoodRand()
{
// We make this a static so we don't have
// to initialize it all the time because
// that is expensive.
static HCRYPTPROV hProvider = 0;
if(hProvider == NULL)
{
if(!::CryptAcquireContext(&hProvider, 0, 0, PROV_RSA_FULL,
CRYPT_VERIFYCONTEXT|CRYPT_SILENT))
return 0;
}
unsigned int randval = 0;
if (!::CryptGenRandom(hProvider, sizeof(unsigned int), static_cast<PBYTE>(&randval)))
randval = 0; // Failure!
return randval;
}
This function will return 0 on failure which is a problem, because 0 is also a possible result from CryptGenRandom and additionally will leak the HCRYPTPROV because it's only available inside the function and once allocated there's no way to release it.
We could augmented it to return true or false accordingly and accept randval by reference from its caller, but that wouldn't solve the HCRYPTPROV leak. Let's instead make a class which has the HCRYPTPROV as a member along with an operator() which will be used to generate new numbers.
Something like this:
class MYPRNG
{
private:
HCRYPTPROV hProvider;
// declare but not define a private copy constructor to
// prevent copy-construction of this object. If you're
// using C++11 you can use the =delete syntax instead.
MYPRNG(const MYPRNG &o) = delete;
// Same with the default assignment operator.
MYPRNG& operator=(const MYPRNG& o)
public:
MYPRNG()
: hProvider(NULL)
{
if(!::CryptAcquireContext(&hProvider, 0, 0, PROV_RSA_FULL,
CRYPT_VERIFYCONTEXT|CRYPT_SILENT))
hProvider = NULL; // ensure that it's NULL
}
~MYPRNG()
{
if(hProvider)
CryptReleaseContext(hProvider, 0);
}
bool operator()(unsigned int &randval)
{
if(hProvider == NULL)
return false;
if (!::CryptGenRandom(hProvider,
sizeof(unsigned int),
static_cast<PBYTE>(&randval)))
return false;
return true;
}
};
Now we have no leaks and we can easily generate random numbers and determine if the operation succeeded or failed reliably. We can use it like this:
MYPRNG prng;
unsigned int rval;
for(int i = 0; i < 10; i++)
{ // try to get 10 random numbers!
if(!prng(rval))
{
// FAILED TO GENERATE A NEW RANDOM NUMBER!
}
else
{
// A new random number is now in rval. Use it
}
}