Entropy & Weak-RNG Lab
Most broken crypto is not broken math — it is bad randomness: a key seeded from too little entropy, a token minted from Math.random() or the clock, a nonce reused. This lab measures real Shannon entropy in your browser and mints tokens with the real CSPRNG (crypto.getRandomValues). You will see a Math.random() token score the same bits/symbol as a secure one yet be fully predictable, replay the Debian 2008 keyspace collapse, brute-force a time-seeded token back out — then make the calls: judge the source, draw enough entropy, and pick the right primitive. And get graded.
The real job. More noise, a tighter clock.
Work the randomness bench
6 graded challenges on why cryptographic randomness matters. You measure real Shannon entropy in your browser, mint tokens from the real CSPRNG (crypto.getRandomValues) versus Math.random(), and replay the classic weak-RNG disasters — the Debian 2008 keyspace collapse, time-seeded PRNGs, constant IVs and starved entropy. Score on correct entropy judgments, predictable-key diagnoses and primitive choices. Clear 75% to pass — finish under par for a speed bonus and a better grade.
What this lab is
- A free, 100% in-browser cryptography lab on randomness: it computes REAL Shannon entropy and mints tokens with the REAL CSPRNG (crypto.getRandomValues) — no server, no account, nothing leaves your machine.
- Measure the Shannon entropy (bits/symbol) of a CSPRNG token, a Math.random() token, a predictable sequence and a password — and see that high per-symbol entropy is necessary but not sufficient for key material.
- Replay the classic weak-RNG disasters: the Debian OpenSSL 2008 keyspace collapse (~32k possible keys), a PRNG seeded from the clock, a hardcoded constant IV, and a reset token derived from a timestamp.
- Watch predictability live — brute-force a time-seeded token back out, and count the collisions a crippled ~2^15 keyspace produces versus a full CSPRNG draw.
- Graded decisions drill the real lessons: judge randomness by its SOURCE, draw enough bytes of entropy, and choose crypto.getRandomValues over Math.random for anything that must be unguessable.
Frequently asked questions
What is the Entropy & Weak-RNG Lab?
A free, browser-based cryptography trainer about randomness. It computes real Shannon entropy on sample strings in your browser and uses the real Web Crypto CSPRNG (crypto.getRandomValues) to demonstrate good randomness, then walks you through graded challenges on measuring entropy, spotting predictable keys (the Debian 2008 bug, time-seeded PRNGs, constant IVs, timestamp tokens) and choosing the right primitive. Everything runs client-side — nothing is sent to a server.
Why is a high Shannon entropy score not enough for a secure key?
Shannon entropy over observed symbol frequencies measures how uniform a string looks, not whether it can be predicted. A Math.random() token can score almost the same bits/symbol as a CSPRNG token, yet Math.random() is a seedable, state-recoverable PRNG — an attacker who learns its state can regenerate every output. Suitability for key material depends on the SOURCE being an unpredictable CSPRNG with enough bytes drawn, so measured entropy is only a sanity check.
What was the Debian OpenSSL 2008 bug?
A 2008 change to Debian's OpenSSL removed entropy the key generator mixed in, leaving effectively the process ID — about 32,768 values — as the only varying seed. Every key on affected systems came from that tiny pool, so attackers could precompute and brute-force them all, and identical keys recurred across machines. The lesson: key strength is bounded by the entropy of the seed, not the length of the key. The fix is to seed from the operating system's CSPRNG.
When is Math.random() actually fine to use?
Math.random() is fine wherever a predictable value causes no harm: back-off jitter, animation timing, shuffling a non-security list, sampling for telemetry. It is wrong for anything an attacker gains from guessing — session tokens, keys, IVs/nonces, password-reset and CSRF tokens all need crypto.getRandomValues(). The test: if an attacker could predict this value, do you lose anything? If yes, use the CSPRNG.
Is any of this sent to a server?
No. The lab is entirely client-side and uses your browser's built-in Web Crypto implementation and local computation. Generated tokens and measurements stay in the page; your best grade is saved only in your own browser's local storage.