random - Is it more secure to use a cryptographically secure PRNG to generate passwords? -

we have script stand new web server @ job. script involves creating number of accounts run services, app pools etc.

we needed create password each of these users -- i.e. generate 32-or-so-character ascii string used logon password.

we had disagreement whether 1 ought use cryptographically-secure prng job, or whether using non-cryptographically secure prng (with time-dependent seed) suffice (we work in .net, concrete decision between generating strings system.random , using rngcryptoserviceprovider -- however, not language-specific issue).

must 1 use cryptographically-secure randomness generating passwords, or sensibly-seeded plain prng sufficient?

in many cases, attacker can recover state of (non-cryptographic) random number generator few output values – without knowing seed. after that, it's trivial predict future , previous random numbers.

how many outputs required depends on algorithm. in case of linear congruential generator, such java's java.util.random, state can recovered 2 outputs. mersenne twister, used in php , python among others, need obtain 624 outputs. i'm not familiar .net, i'd think it's similar story.

there no complex math involved @ all. see yourself:

• linear congruential generator, part 1
• linear congruential generator, part 2
• mersenne twister, part 1
• mersenne twister, part 2

conclusion: use cryptographically secure random number generator has security.