Can malloc or the new operator be used to obtain random values?

[Mapler]

I'm implementing the socket part of my C++ program and I was wondering on how to implement the IV for the AES encryption. The IV is a unique array of bytes that is used in combination with the key to make it harder for an attacker to read what is being sent. I had the idea of using the current time and the malloc function (on the client's side) to generate a random array of characters.

These random numbers are only generated once in the application's lifetime. Is it fine to use the new/malloc function for randomness if only used once? Are there any drawbacks on this method? I'm still fairly new to encryption.

//create iv
srand(time(0));
for(int i = 0; i < 8; ++i){
	//by convention the server send context goes first
	iv_recv_[i * 2] = rand() % 256;
	iv_send_[i * 2] = rand() % 256;
}

int *random_address = new int;
srand((long long)(random_address));
for(int i = 0; i < 8; ++i){
	iv_recv_[i * 2 + 1] = rand() % 256;
	iv_send_[i * 2 + 1] = rand() % 256;
}

delete random_address;

[mbozzi]

Use exactly a purpose-built CSRNG, not some undefined behavior hack and the hilariously awful std::rand.

Are there any drawbacks

A program which potentially accesses an uninitialized variable has undefined behavior. (Your program's wrong).

The compiler will transform your code under the assumption that it follows the rules. The behavior of a program that breaks this assumption is unpredictable - e.g., it may succeed randomly, silently yield the wrong answer, or crash.

std::rand() is not suitable for use in encryption. It doesn't have enough state, fails statistical tests for randomness, the period is too short and it's usually predictable just by looking at it.

[keskiverto]

@mbozzi: What uninitialized variable is accessed?

@Mapler: Do you have any idea how systematic the OS could be on memory allocation?

rand():
https://channel9.msdn.com/Events/GoingNative/2013/rand-Considered-Harmful
leads to:
http://www.cplusplus.com/reference/random/mersenne_twister_engine/mersenne_twister_engine/

But, you really want to read:
http://www.pcg-random.org/posts/simple-portable-cpp-seed-entropy.html

[mbozzi]

What uninitialized variable is accessed?

Given int *random_address = new int;, *random_address is default-initialized, and has an indeterminate value. Using that value is undefined behavior.

https://en.cppreference.com/w/cpp/language/default_initialization
http://eel.is/c++draft/dcl.init#12

Edit: Nevermind this, I misread the post.

[tpb]

You get two values for the price of one:

#include <iostream>

int main() {
    auto p = new int;
    delete p;
    std::cout << "Heap : " << p << '\n';
    std::cout << "Stack: " << &p << '\n';
}

You can't portably rely on them being random, though.

[Mapler]

@keskiverto Thanks for your much more constructive advice. I'll definitely try using the better c++11 libraries from now on.

[jonnin]

when I was in school, I colored a fractal for an assignment by using an uninitialized variable. This used what was on the call stack in a predictable fashion, coloring it in a very interesting pattern (each depth of the recursion was the same color, of course).

which is to say that uninitialized variables tend to just be what was there before and its not at all very random.