Randomness in cryptography

Cryptography fails if secrets are guessable. Keys, IVs, nonces and session tokens depend on high-quality randomness. Weak RNG has broken real systems in the wild.

Hashes are not keys

SHA-256 is a public function: anyone can compute it. Security for draws comes from binding published inputs so manipulation is visible — different from keeping a private encryption key.

Shared lesson

Whether securing a TLS handshake or a raffle, document where entropy comes from and never pretend a secret seed is “fair” without proof.