5.3 Randomization, Random vs. Pseudorandom Numbers, and Scaling to a Range
Key Takeaways
- A pseudorandom number generator is a deterministic algorithm: the same seed always produces the same sequence, which makes programs reproducible but predictable.
- True random numbers come from unpredictable physical processes, such as electrical noise, and are used where unpredictability is critical.
- Security uses such as passwords, keys, and session tokens need a cryptographically secure generator, not an ordinary pseudorandom generator.
- If random ( ) returns a value r with 0.0 ≤ r < 1.0, then floor ( r * ( high − low + 1 ) ) + low gives an integer from low to high inclusive, each equally likely.
- Randomization is appropriate for simulations, games, fair sampling and assignment, randomized algorithms such as a random quicksort pivot, and generating test data.
What this competency asks
ETS asks you to be familiar with the use of randomization in computing:
- Identify appropriate uses of randomization in a variety of applications.
- Identify the difference between random and pseudorandom numbers.
The discussion questions add a practical skill: transforming a random number generator to fit a specific range.
Where randomization is appropriate
| Use | Why randomness helps | Example |
|---|---|---|
| Simulation (Monte Carlo) | Models uncertain events and estimates probabilities by running many trials | Simulating customer arrivals to size a checkout line |
| Games | Unpredictability makes games fair and interesting | Dice rolls, card shuffles, enemy behavior |
| Sampling | Every member has an equal chance, which reduces selection bias | Choosing 100 students at random for a survey |
| Fair assignment | Removes the chooser's bias | Randomly assigning lab partners; random treatment groups in experiments |
| Randomized algorithms | Avoids a consistently bad worst case | A random pivot makes quicksort's O(n²) case very unlikely on sorted input |
| Testing | Generates many varied inputs automatically | Random test data; "fuzz testing" with random inputs |
| Security | Values must be unguessable | Encryption keys, password salts, session tokens |
| Procedural content | Creates variety without hand-authoring | Terrain or levels in a game |
Randomness is not appropriate when results must be exactly reproducible and fair in a deterministic sense, such as computing grades or bank balances. It is also inappropriate when the "random" choice would hide a bias, for example "randomly" checking only the first few records.
Random vs. pseudorandom
True random numbers come from physically unpredictable processes, such as electrical (thermal) noise, radioactive decay, or other hardware noise sources. Future values cannot be predicted even with complete knowledge of past values.
Pseudorandom numbers are produced by a deterministic algorithm, a pseudorandom number generator (PRNG). A PRNG starts from a seed and applies a formula to produce each next value. The output passes statistical tests for randomness, but:
- The same seed always produces the same sequence. That is useful for reproducible simulations and debugging.
- The sequence eventually repeats (it has a period).
- Someone who knows the algorithm and the state can predict future values.
A tiny pseudorandom generator
A classic PRNG is the linear congruential generator: next = (a × current + c) % m. With a = 5, c = 3, m = 16, and seed 7:
| Step | Calculation | Value |
|---|---|---|
| seed | — | 7 |
| 1 | (5 × 7 + 3) % 16 = 38 % 16 | 6 |
| 2 | (5 × 6 + 3) % 16 = 33 % 16 | 1 |
| 3 | (5 × 1 + 3) % 16 = 8 % 16 | 8 |
| 4 | (5 × 8 + 3) % 16 = 43 % 16 | 11 |
| 5 | (5 × 11 + 3) % 16 = 58 % 16 | 10 |
The values look scattered, but anyone who knows the formula and the seed can reproduce them exactly. Real generators use much larger numbers and better formulas, but the principle is the same.
Security needs a stronger generator
Because ordinary PRNGs are predictable, security-sensitive values such as passwords, encryption keys, salts, and session tokens must come from a cryptographically secure random generator. Such a generator is seeded from unpredictable system sources of randomness (entropy) and designed so that its outputs cannot be predicted. Seeding a generator with the current time is a classic mistake, because an attacker can guess the seed.
Transforming a generator to a range
Assume a library procedure random ( ) returns a double r with 0.0 ≤ r < 1.0, and floor ( x ) returns the greatest integer less than or equal to x.
// returns an integer from low to high, inclusive
int randomBetween ( int low, int high )
double r ← random ( )
return floor ( r * ( high - low + 1 ) ) + low
end randomBetween
Why it works, for a six-sided die (low = 1, high = 6):
high - low + 1is 6, the number of possible values.r * 6falls in [0, 6), so its floor is 0, 1, 2, 3, 4, or 5, each with equal probability.- Adding
lowshifts the range to 1–6.
| Common mistake | Result |
|---|---|
Using high - low instead of high - low + 1 | high can never occur (a die that never rolls 6) |
Forgetting + low | Range starts at 0 instead of low |
Rounding instead of flooring, such as round ( r * 5 ) + 1 | All six values occur, but 1 and 6 occur only half as often as the others |
Taking a large random integer % n when the generator's range is not a multiple of n | Small values become slightly more likely than large ones |
Other transformations follow the same logic. A generator that returns 1–6 becomes 0–5 by subtracting 1. A random even number from 0 to 10 is 2 * randomBetween ( 0, 5 ). A random true or false is random ( ) < 0.5, and a 30% chance is random ( ) < 0.3.
Randomness in simulations
Randomized simulations estimate rather than compute exactly. Flip a simulated fair coin 10 times and you might see 7 heads. Flip it 10,000 times and the proportion of heads will almost always be very close to 0.5. More trials give more reliable estimates, but each run can still differ unless you fix the seed. Section 14.2 covers simulation and modeling in more depth.
A student runs a simulation twice using a pseudorandom number generator seeded with the same value both times, and no other inputs change. What will the student observe?
The procedure random ( ) returns a double r with 0.0 ≤ r < 1.0, and floor ( x ) returns the greatest integer ≤ x. Which expression produces a random integer from 5 to 12, inclusive, with each value equally likely?
A web application needs to generate password-reset tokens that attackers must not be able to guess. Which approach is appropriate?