# [Solved] CryptGenRandom Entropy

CryptGenRandom is a random number generator function in CryptoAPI in Windows. How much entropy has that random number generator ? I have already looked a lot, but I couldn’t find it.

##
Solution #1:

The exact algorithm of Windows CryptGenRandom was never published, therefore, some security experts suggest not to use it at all.

Some reverse-engineering and cryptanalysis was made.

A published research (Cryptanalysis of the Windows Random Number Generator – Leo Dorrendorf, 2007) examined Windows 2000 RNG and found a number of

weaknesses in the design and implementation.

The document also describes the entropy collector mechanism of the algorithm (section 4.2.3). The Entropy sources are:

```
Source Bytes requested
CircularHash 256
KSecDD 256
GetCurrentProcessID() 8
GetCurrentThreadID() 8
GetTickCount() 8
GetLocalTime() 16
QueryPerformanceCounter() 24
GlobalMemoryStatus() 16
GetDiskFreeSpace() 40
GetComputerName() 16
GetUserName() 257
GetCursorPos() 8
GetMessageTime() 16
NTQuerySystemInformation calls:
ProcessorTimes 48
Performance 312
Exception 16
Lookaside 32
ProcessorStatistics up to the remaining length (3584 bytes buffer)
ProcessesAndThreads up to the remaining length
```

Since we are talking about a pseudo-number-generator and not a real-number-generator, you may say that there is no real entropy at all, or count only the sources that you may consider as “entropy” (pseudo-entropy).

I was unable to find information regarding newer versions on Windows.