[CryptoAPI] which random number generator does Generate_Password use?

Back to Forums

bfcantante

Solved

Question

Forge

ODC

Hi,

We use CryptoAPI (ODC), v1.0.8, in a production app. We call the Generate_Password action to create short-lived (5 min), single-user access tokens (64 characters), so we need to be sure the randomness is cryptographically secure.

Could you please confirm which random number generator the Generate_Password action uses to pick the characters? For example:

- System.Security.Cryptography.RandomNumberGenerator

- BouncyCastle SecureRandom

- System.Random (or similar non-cryptographic generator)

Thank you very much for the component and for your help!

14 hours ago

Ricardo Monteiro

Solution

Hi @bfcantante,

I decompiled the CryptoAPI library and checked the Generate_Password.

It uses System.Security.Cryptography.RandomNumberGenerator, so the first option on your list.

For your use case (64-character, short-lived tokens):

Each character takes its own 4 CSPRNG bytes and is mapped onto a 62-character alphabet (`A–Z a–z 0–9`).
The modulo-62 mapping has a negligible bias, about 1 in 70 million per character, which isn't practically exploitable.
A 64-character token from a 62-symbol alphabet has roughly 380 bits of entropy.
The output has no symbols, so if your token format needs them, you'd have to add them yourself.

Caveat: I inspected the version in my tenant, tagged 1.0.10, not 1.0.8, which is what you're running. I haven't looked at 1.0.8 and can't say it behaves the same. You can check it yourself by downloading the library's source from ODC and decompiling the DLL with ILSpy. The maintainers can also confirm for 1.0.8.

13 hours ago

bfcantante

Thank you Ricardo.

12 hours ago

Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.

See the full guidelines