Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's not a java.security file on Android for now as much as I know. How can I do this selection?

share|improve this question

1 Answer

up vote 6 down vote accepted

This distinction doesn't exist under Android. Android did it right -- there's just a single randomness source (unless the system opts to provide others) that provides randomness that is guaranteed to be cryptographically-secure. The platform ensures it's seeded, so there's nothing you need to do.

share|improve this answer
Thanks David. As you pointed out, it's written on the documentation that: "By default, instances of this class will generate an initial seed using an internal entropy source, such as /dev/urandom. This seed is unpredictable and appropriate for secure use." However what I'm planning to do is, to generate random numbers using SHA1PRNG with seeds from dev/random and dev/urandom, then check the obtained random numbers with randomness tests for comparison. As the documentation says a blurry exp like "from such as /dev/urandom" it's not clear which file is used generate the seed. – Rubi Sharmax May 7 '12 at 5:40
They will be the same because /dev/random and /dev/urandom use precisely the same mechanism. The only difference is that one blocks and the other doesn't when there's insufficient entropy -- but that can never happen on Android because Android seeds on startup. If you're trying to get at the internals, Android is a pure choice of platform do that because Android doesn't expose those internals. IMO, It only makes sense to analyze the difference on a platform that exposes both. – David Schwartz May 7 '12 at 7:55
Thanks again David, I guess I'll need to build Android platform for both dev/random and dev/urandom as the selected seed source and then install on my device. Hope I can switch between dev/random and dev/urandom on the Android source code. It feels like Android will permit because both dev/random and dev/urandom exist on the Android system. On the other hand, trying on a different platform is another choice as you implied. – Rubi Sharmax May 7 '12 at 8:08
@RubiSharmax, don't do that! Don't use /dev/random. It is very likely that you should not be using /dev/random. If you think you want to use it, odds are that you are confused. (You never stated why you want to use /dev/random.) /dev/random has no security advantages (for almost any application), and it has major performance disadvantages (it blocks; it depletes the entropy pool for others). Search this site for more about /dev/random vs /dev/urandom. – D.W. May 8 '12 at 21:47
4  
@RubiSharmax: There is no difference, so long as the entropy pool has ever been seeded since system startup. This is an intentional design property. /dev/urandom provides water, /dev/random provides holy water. If you discover a test that can tell one from the other, you will be famous. – David Schwartz May 9 '12 at 8:23
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.