9

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's not a java.security file on Android for now as much as I know. How can I do this selection?

1

1 Answer 1

9

This distinction doesn't exist under Android. Android did it right -- there's just a single randomness source (unless the system opts to provide others) that provides randomness that is guaranteed to be cryptographically-secure. The platform ensures it's seeded, so there's nothing you need to do.

8
  • Thanks David. As you pointed out, it's written on the documentation that: "By default, instances of this class will generate an initial seed using an internal entropy source, such as /dev/urandom. This seed is unpredictable and appropriate for secure use." However what I'm planning to do is, to generate random numbers using SHA1PRNG with seeds from dev/random and dev/urandom, then check the obtained random numbers with randomness tests for comparison. As the documentation says a blurry exp like "from such as /dev/urandom" it's not clear which file is used generate the seed. May 7, 2012 at 5:40
  • They will be the same because /dev/random and /dev/urandom use precisely the same mechanism. The only difference is that one blocks and the other doesn't when there's insufficient entropy -- but that can never happen on Android because Android seeds on startup. If you're trying to get at the internals, Android is a pure choice of platform do that because Android doesn't expose those internals. IMO, It only makes sense to analyze the difference on a platform that exposes both. May 7, 2012 at 7:55
  • Thanks again David, I guess I'll need to build Android platform for both dev/random and dev/urandom as the selected seed source and then install on my device. Hope I can switch between dev/random and dev/urandom on the Android source code. It feels like Android will permit because both dev/random and dev/urandom exist on the Android system. On the other hand, trying on a different platform is another choice as you implied. May 7, 2012 at 8:08
  • @RubiSharmax, don't do that! Don't use /dev/random. It is very likely that you should not be using /dev/random. If you think you want to use it, odds are that you are confused. (You never stated why you want to use /dev/random.) /dev/random has no security advantages (for almost any application), and it has major performance disadvantages (it blocks; it depletes the entropy pool for others). Search this site for more about /dev/random vs /dev/urandom.
    – D.W.
    May 8, 2012 at 21:47
  • 6
    @RubiSharmax: There is no difference, so long as the entropy pool has ever been seeded since system startup. This is an intentional design property. /dev/urandom provides water, /dev/random provides holy water. If you discover a test that can tell one from the other, you will be famous. May 9, 2012 at 8:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .