[Bug 236010] rand(3) values strongly correlate with time while this doesn't have to be the case

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=236010

            Bug ID: 236010
           Summary: rand(3) values strongly correlate with time while this
                    doesn't have to be the case
           Product: Base System
           Version: 12.0-STABLE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: misc
          Assignee: bugs at FreeBSD.org
          Reporter: yuri at freebsd.org

---Problem description---
This simple program
> #include <stdlib.h>
> #include <stdio.h>
> int main() {
>   srand(time(0));
>   printf("%d\n", rand());
> }
demonstrates how a lot of software uses srand(3)/rand(3) functions.

The first random number seems to strongly correlate with time, here are
subsequent run outputs:
> $ ./rand 
> 50768478
> $ ./rand 
> 50785285
> $ ./rand 
> 50802092
> $ ./rand 
> 50818899
> $ ./rand 
> 50852513
> $ ./rand 
> 50869320

It's always 50,000,000-something, which is strongly correlated with time.

---Practical problem that this causes---
Please observe this use of rand(3):
https://github.com/ccxvii/mujs/blob/master/jsmath.c#L71 When the rand(3) output
is simply mapped to a floating point like this, the resulting floating point
values aren't random at all from run to run. Somebody could use such floating
point pseudo-random number, truncate the less significant digits, and get a
completely predictable values. The consecutive outputs of this routine that I
observed are: 0.03040289788544448, 0.03041072425470755, 0.03041072425470755.

---Proposed solution---
Some 32-bit hash function can be used on the seed value that would map the
value to a less seemingly related value.

-- 
You are receiving this mail because:
You are the assignee for the bug.