When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's not a java.security file on Android for now as much as I know. How can I do this selection?
1 Answer
This distinction doesn't exist under Android. Android did it right -- there's just a single randomness source (unless the system opts to provide others) that provides randomness that is guaranteed to be cryptographically-secure. The platform ensures it's seeded, so there's nothing you need to do.
-
Thanks David. As you pointed out, it's written on the documentation that: "By default, instances of this class will generate an initial seed using an internal entropy source, such as /dev/urandom. This seed is unpredictable and appropriate for secure use." However what I'm planning to do is, to generate random numbers using SHA1PRNG with seeds from dev/random and dev/urandom, then check the obtained random numbers with randomness tests for comparison. As the documentation says a blurry exp like "from such as /dev/urandom" it's not clear which file is used generate the seed. Commented May 7, 2012 at 5:40
-
They will be the same because
/dev/randomand/dev/urandomuse precisely the same mechanism. The only difference is that one blocks and the other doesn't when there's insufficient entropy -- but that can never happen on Android because Android seeds on startup. If you're trying to get at the internals, Android is a pure choice of platform do that because Android doesn't expose those internals. IMO, It only makes sense to analyze the difference on a platform that exposes both. Commented May 7, 2012 at 7:55 -
Thanks again David, I guess I'll need to build Android platform for both dev/random and dev/urandom as the selected seed source and then install on my device. Hope I can switch between dev/random and dev/urandom on the Android source code. It feels like Android will permit because both dev/random and dev/urandom exist on the Android system. On the other hand, trying on a different platform is another choice as you implied. Commented May 7, 2012 at 8:08
-
@RubiSharmax, don't do that! Don't use /dev/random. It is very likely that you should not be using /dev/random. If you think you want to use it, odds are that you are confused. (You never stated why you want to use /dev/random.) /dev/random has no security advantages (for almost any application), and it has major performance disadvantages (it blocks; it depletes the entropy pool for others). Search this site for more about /dev/random vs /dev/urandom.– D.W.Commented May 8, 2012 at 21:47
-
6@RubiSharmax: There is no difference, so long as the entropy pool has ever been seeded since system startup. This is an intentional design property.
/dev/urandomprovides water,/dev/randomprovides holy water. If you discover a test that can tell one from the other, you will be famous. Commented May 9, 2012 at 8:23
/dev/urandomis great and possibly better.