lrand48

lrand48 is a function that, in C programs, returns an apparently random integer. “Apparently random” means: the number looks random, but is produced by a fixed mathematical formula. Such methods are called pseudo-random generators — “pseudo” comes from the Greek word for false or feigned. lrand48 always returns a number between 0 and 2³¹−1 (i.e. 2,147,483,647), never a negative number. The function originates from the POSIX standard, a shared set of rules for Unix-like operating systems such as Linux or macOS.

lrand48 as a building block for reproducible randomness

Many programs need numbers that cannot be predicted: games, simulations, cryptography. True randomness is hard for a computer to produce because it always works deterministically — the same input yields the same output. Pseudo-random generators solve this in practice: they deliver sequences of numbers that are statistically well distributed and sufficient for most purposes.

One particular advantage is reproducibility. If you start lrand48 with the same starting value (the so-called seed), you get exactly the same sequence of numbers — every time. This may sound like a drawback at first, but it is valuable for tests and simulations: you can repeat an experiment precisely and check whether the program behaves correctly.

The linear congruential method behind the function

lrand48 works using a method called a linear congruential generator. The idea is simple: you take the last state, multiply it by a fixed large number, add another fixed number, and then take the remainder of a division. The result is the new state — and at the same time the next “random number”. The 48 in the name refers to the internal state size: the generator internally manages a 48-bit value, i.e. a number with 48 digits in binary.

Related functions from the same family are srand48, which sets the starting value, drand48, which returns a decimal number between 0 and 1, and mrand48, which can also return negative numbers. They all share the same internal state. lrand48 always returns non-negative values, which makes it particularly easy to use for computing indices or positions — for example, a random spot in a list.

A well-known weakness: the internal state of 48 bits is very small by today’s standards. An attacker can compute the entire sequence once they know a few output values. For cryptography — that is, wherever genuine security is required — lrand48 is therefore unsuitable.

lrand48 in older systems and scientific code

lrand48 mainly appears in older code: in Unix programs from the 1980s and 1990s, in scientific simulations, and in textbooks on systems programming. Anyone reading code contributions in open-source projects today occasionally comes across lrand48 in parts that have remained unchanged for decades.

In modern C projects, lrand48 is usually replaced by newer alternatives. On Linux, for instance, getrandom is available, which draws genuine randomness from operating system sources. For portable programs without security requirements, rand from the C standard library is common. Nevertheless, lrand48 is not a pure museum piece: the POSIX standard still mandates it to this day, which is why it is available on practically every Linux or macOS system.

In tech news, one is most likely to encounter lrand48 when security researchers analyze old software and show how attackers predicted a program’s pseudo-random generator in order to compromise it. Such reports make clear why choosing the right random number generator is no small matter.