Pick the right entropy source for the use case

Challenge

Match each use case to the right entropy source. Picking rand() for anything security-sensitive is the root of many CVEs.

Task

Implement int recommend_entropy_source(int use_case) that maps a use-case code to a recommended source code.

Source codes:

• 0 = rand() — fast, deterministic, NOT for security.
• 2 = getrandom(2) — Linux 3.17+, preferred for security (no fd needed).

Use cases:

• 0 = Bingo number for a game UI
• 1 = session token for a web server
• 2 = cryptographic nonce
• 3 = filling a debug buffer with garbage
• 4 = CSRF token

Input

• use_case: one of the integers above. The grader passes fixed values.

Output

Returns int:

• 0 for cases 0 and 3 (non-security).
• 2 for cases 1, 2, and 4 (security — prefer getrandom).
• -1 for any unknown use case.

Example

recommend_entropy_source(0)   ->   0   (game)
recommend_entropy_source(1)   ->   2   (session token)
recommend_entropy_source(4)   ->   2   (CSRF token)
recommend_entropy_source(99)  ->   -1  (unknown)

Edge cases

• Any code outside 0..4 returns -1.

Rules

• This is a decision table only — no real syscalls or randomness.

Why this matters

rand()/srand(time(NULL)) is the entropy source used in too many security CVEs. Choosing the right call matters.

Input format

An integer use_case (0..4 are defined).

Output format

An int: 0 (non-security), 2 (security/getrandom), or -1 (unknown).

Constraints

Decision table only — no real syscalls.

Starter code

int recommend_entropy_source(int use_case) { /* TODO */ (void)use_case; return -1; }

Common mistakes

Using rand() for security. Using /dev/urandom when getrandom is available.

Edge cases to handle

Unknown use_case.

Complexity

O(1).

Background lessons

• Memory safety — the whole bug class