Which PRNG is used?

[reitzig]

It is not clear to me, neither from documentation nor code, which of the two PRNGs provided by Common Crypt you use/expose here. Can you please elaborate in the documentation?

[iosdevzone]

To the best of my knowledge Common Crypto only supplies on routine to generate random numbers: CCRandomGenerateBytes.

There is relatively little documentation provided by Apple on the routine. The header file mentions that it is cryptographically strong. (See CommonRandom.h )

Of course, the API gets updated every now and then so perhaps I missed something. Could you be more specific about the two PRNGs you are referring to?

[reitzig]

There are indeed newer releases, but the part I meant is in the one you link into as well:

we provide two RNGs to call, kCCRandomDefault (the NIST
one) and kCCRandomDevRandom (a managed wrapper around
/dev/random). If you are doing anything involving security, call
the default one. You'll be glad you did, because it does much
security-related housekeeping for you and you don't have to
think about it. Really.

From CommonRandomSPI.h

[iosdevzone]

The file CommonRandomSPI.h, as far as I know, is part of the internal implementation of CommonCrypto and is not part of the public interface. You could call it by dynamically resolving the symbols, but I do not know if your app would be accepted in the App Store. You can find the current public headers for CommonCrypto on macOS on your system in /usr/include/CommonCrypto. Platform specific headers are in locations such as /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/usr/include/CommonCrypto assuming Xcode is installed in the default location.

For the moment, I do not want to add anything to IDZSwiftCommonCrypto that would risk apps using getting rejected from the app store.

If newer releases provide additional public functionality I will try to support it. Which newer releases are you talking about?

[reitzig]

I see; I didn't realize these headers were private, my bad. I wouldn't want to propose exposing internal features, that's clearly a bad idea.

You're linking into 60074 while the source browser shows plenty of higher numbers which I assumed were newer versions. There's even a version 7, but that does not seem to be complete yet.

[iosdevzone]

Oh, I see (on the source browser), I was just using that as a way to provide a simple clickable reference to a header file, sorry for the confusion. The definitive ones are the ones in the SDKs on your machine. Although the open source site seem to be being updated more frequently now, the ones shipping with the most recent SDKs are often even newer.

On the public/private issue, there was a library SwSwift that was dynamically loading symbols not "advertised" in the header files (see #34 for more info). I am not sure whether any app store apps used that library.

Anyway glad we could clear up the confusion. Let me know if you need any more assistance with the library.