title: RandomNumberGenerator proper usage
body: <p>I would like to generate a salt using a secure PRNG. I've read that the newest and recommended way to achieve this is to create a <code>RandomNumberGenerator</code> instance to <code>GetBytes</code>. However, I am not so sure which way should I follow:</p>
  
  <pre><code>// CODE 1
  
  private static byte[] GenerateSaltNewInstance(int size)
  {
      using (var generator = RandomNumberGenerator.Create())
      {
          var salt = new byte[size];
          generator.GetBytes(salt);
          return salt;
      }
  }
  
  // CODE 2
  
  private static RandomNumberGenerator rng = RandomNumberGenerator.Create();
  
  private static byte[] GenerateSaltStatic(int size)
  {
      var salt = new byte[size];
      rng.GetBytes(salt);
      return salt;
  }
  </code></pre>
  
  <p>What is the difference? Basically in the first version of this method I am creating a new instance of <code>RandomNumberGenerator</code> every time. In the second one I am using a static instance initialized once.</p>
  
  <p>Which one should I choose? In articles I see people following the first path, but I don't feel why it would be a better idea to create <code>RandomNumberGenerator</code> 10000 times :P Does it make it more secure to use a new instance each time?</p>