Computers are pretty bad at making random numbers. They are deterministic machines by nature. There are true random number generators, available for purchase online as USB devices. My focus, however, is on pseudorandom number generators. These are algorithms that can take an initial value, called a seed, and produce a long stream of numbers that appear random. This seed is often taken from some source of randomness on the host computer, such as the time, the number of threads, the amount of available memory, or any number of other metrics. When given the same initial seed, the generator will always produce the same stream.
So what is random? Well, there are several metrics to measure the quality of a random number generator. Uniformity is the most basic – over a large stream of random numbers, every value should appear roughly equally. Serial correlation is the next measure. Do successive numbers share a simple relationship? In the classic linear congruential generator, the outputs alternated between odd and even, which isn’t very random. Finally, the period of a random number generator is the quantity of random numbers that will be generated before the generator loops around and starts repeating. It is desirable for the period to be significantly larger than will ever be used.
How random is random enough? Well, it depends on the application. A scheduling application might want to spread some tasks out in time, and that doesn’t require a great deal of randomness. A game or Monte Carlo simulation has some stronger requirements, you want the numbers to be fairly random, but malicious users aren’t typically a concern. For cryptographic purposes, such as random password generation, the numbers have to be very random. Specifically, the serial correlation has to be virtually nil, as it is undesirable for an attacker to be able to predict the next password generated by the algorithm.
