Putting It All Together

Layers:

Production tips:

• Use secrets (Python), crypto.randomBytes() (Node), SecureRandom (Java).
• Don't seed CSPRNGs from user input or low-entropy sources.
• DON'T use Math.random(), random.random(), rand() for security.
• For UUIDs: UUIDv4 (random) is OK for IDs but use 32-byte tokens for auth.
• Re-seed periodically in long-running services (less critical with modern kernels).

What we glossed over:

• Zero-knowledge proof randomness: needs uniformly random scalars in a specific field.
• Quantum random: hardware that uses quantum effects (vacuum fluctuations, photon counting). Slow but truly random.
• Bias correction: hardware sources may have small biases; von Neumann extractor fixes.
• Predictability after compromise: forward + backward secrecy via state rotation.

Where you've seen CSPRNGs:

• TLS handshake nonces
• AES IVs (especially GCM)
• JWT signing key generation
• Session IDs in every web framework
• OAuth state tokens
• Password salts
• TOTP / HOTP seeds
• WireGuard private keys

You now understand the foundation underneath every secure protocol.