title: RandomNumberGenerator vs RNGCryptoServiceProvider
body: <p>According to MSDN documentation for <a href="http://msdn.microsoft.com/en-us/library/system.security.cryptography.randomnumbergenerator%28v=VS.71%29.aspx" rel="noreferrer">RandomNumberGenerator</a>:</p>
  <blockquote>
  <p>Application code does not directly use this class. This abstract class is provided as the base class for all cryptographic random number generators.</p>
  <p>For an implementation of a cryptographic random number generator, use the derived class RNGCryptoServiceProvider.</p>
  </blockquote>
  <p>However, I have seen the following code used on a few occassions in different code bases:</p>
  <pre><code>byte[] bytes = new byte[...];
  RandomNumberGenerator rng = RandomNumberGenerator.Create();
  rng.GetBytes(bytes);
  </code></pre>
  <p>Most notably with <a href="http://code.google.com/p/stackid/source/browse/OpenIdProvider/Current.cs#1135" rel="noreferrer">StackExchange</a> (which I assume includes SO) and also with <a href="http://bcrypt.codeplex.com/SourceControl/changeset/view/1eef0262901c#BCrypt.Net/BCrypt.cs" rel="noreferrer">BCrypt.Net</a>.</p>
  <p>Therefore, I am a little confused - what type of <code>RandomNumberGenerator</code> is the above code returning? Also is it a bit of a flaw that some code bases <em>are</em> using <code>RandomNumberGenerator</code> rather than <code>RNGCryptoServiceProvider</code>?</p>
  <p>I assume <code>RandomNumberGenerator.Create()</code> is doing under the hood which I am completely missing here, but technically (as it's an abstract class) shouldn't the above code throw an error?</p>