🎲 Generating cryptographically secure random values in C and C++ – what are your options?

[marcelschmall@infosec.exchange]

Generating cryptographically secure random values in C and C++ – what are your options?

After writing about how secure random links work, a few people asked about the underlying libraries. So here is a quick overview.

libsodium is the easiest and most recommended choice. One function call, cross-platform, and built specifically for cryptography:

randombytes_buf(buffer, size);

That is really all there is to it. libsodium picks the best available entropy source on the OS automatically.

OpenSSL / LibreSSL is the classic option. RAND_bytes() does the job and is available almost everywhere. Worth using if you already have OpenSSL as a dependency – otherwise libsodium is cleaner.

️ If you want no external dependency at all, go directly to the OS:

Linux: getrandom() – available since kernel 3.17
macOS / BSD: arc4random_buf() – even simpler, no error handling needed

Both are solid choices for system-level code.

️ What about std::random_device in C++? It looks convenient but the standard does not guarantee cryptographic security. On some platforms it falls back to a predictable seed. Fine for games or simulations – not for security-critical code.

So for anything security-related: libsodium or the OS primitives directly. std::random_device is a trap if you care about real randomness.

What do you use in your projects for secure randomness? Still rolling your own or already on libsodium?

#CPlusPlus #C #Security #Cryptography #libsodium #Infosec #SystemsProgramming