On Friday 29 January 2010 12.51:20 Joe Kramer wrote:
> So this means random()+random() is not random even within 2,000,000
> iterations!
>
Exactly the issue I wrote about: random() apparently doesn't deliver enough
randomness.
Even if it did: quote_literal(random() + random()) is ca. 14 to 16 decimals,
so this gets you ca. 40 to 50 bits of randomness (again: assuming random()
actually can produce it! You'll really have to look into the implementation
of random() for all your supported versions of pg and platforms!)
So, of the 160 bit that are possible for a sha1 hash, your're only using 25%
(and that's 25% of the bits. That means you're only using 1e12 of the
1.4e48 possible values. which is about
0.000000000000000000000000000000000001% if my math isn't totally bogus.
(Read up about the birthday paradoxon to get an idea on how likely a
collision is depending on how long your random number is.)
cheers
-- vbi
--
featured link: http://www.pool.ntp.org
