If I retrieve a random number from a database (e.g. RAND() in SQL Server) or using a programming language and send this in some form back to a client machine, is there an economic chance I will be sending an indicator of what’s in my server’s memory that might form a security problem (like revealing my schema, etc)?
7
No, the specific thing that you are concerned about (inspired by Heartbleed?) will not happen. A random number generator does not simply pull bytes from memory (that’s not very random). You can assume that the random number generator will not leak private information to clients.
2
The only part of memory used is a designated buffer which is used only for the number generation.
The real risk of RNG is predictability, for key generation you need random data, if it isn’t random an attacker can guess the key and break your encrypted data.
1