1

I ran a gpg --gen-key on a remote machine connected with SSH and left it to do its job. It finished successfully, however during the execution time it asked to perform random actions to collect more entropy.

First message claimed GnuPG required 162 bytes, then: 212, 243, and 250.
On the second run: 178, 202, 249, 245.
On the third: 224, 193, 247, 246.

Why doesn't this number decrease steadily (and instead increases in some cases)?

Side question: why does it always seem to finish after 4th warning?

$ gpg --gen-key
gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.    

(...)

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 162 more bytes)
.....+++++

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 212 more bytes)
............+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 243 more bytes)
......+++++

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 250 more bytes)
..+++++
gpg: ~/.gnupg/trustdb.gpg: trustdb created
gpg: key 8458470F marked as ultimately trusted
public and secret key created and signed.

1 Answer 1

3

The reason for this is indeed not obvious from the GnuPG user interface.

RSA key generation requires to random prime numbers. GnuPG generates a primary key and an encryption subkey by default. Both of them are usually RSA keys, so they require two primes each, totaling four. This is also visible in the following message being printed twice, once for each RSA key:

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

After this, the two random numbers (which act as starting points for searching primes) are retrieved:

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 243 more bytes)
......+++++

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 250 more bytes)
..+++++

The number of bytes can differ each time you generate keys because there might be additional entropy generated after enough random bytes have been available.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .