9

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat counters), the process' environment block, high-precision CPU counters, exception information, process information, and more. I have two questions about this entropy collection:

  1. Are all these entropy sources still used on modern Windows, more than a decade later?

  2. Are these sources queried at each randomness request, or is an entropy pool used?

The only two sources I could find give no information for modern Windows (post-XP).

Improve this question
11
  • iirc, they use fortuna, which means a pool. CryptGenRandom has largely been outmoded by .NET's RNGCryptoServiceProvider, which uses HWRNG.
    – dandavis
    Apr 5, 2018 at 22:48
  • It appears that Microsoft has deleted the comment I linked to which detailed these sources some time after I posted this question. Whether or not this is coincidence or a response to "leaked" information, I don't know. If anyone can supply an archive of that comment, I would appreciate it.
    – forest
    May 12, 2021 at 6:28
  • Here's the Win10 DRBG FIPS 140-2 cert. That page doesn't contain any useful info, but I wonder if questions could be asked to get access to some of the implementation docs for that certification?
    – Mike Ounsworth
    May 12, 2021 at 14:20
  • 1
    @forest, I updated the link to an archived version.
    – nobody
    May 12, 2021 at 20:17
  • @nobody Thanks! That's strange. I tried to open it in the Web Archive but it only claimed to have crawled it once in 2021 and once in 2020. How'd you find one from 2018?
    – forest
    May 12, 2021 at 22:09

1 Answer 1

Reset to default
0

  1. Are all these entropy sources still used on modern Windows, more than a decade later?

  2. Are these sources queried at each randomness request, or is an entropy pool used?

  1. When you say Modern Windows, do you mean Windows 10 and up? CryptGenRandom has been deprecated in favor of Cryptography Next Generation API: https://docs.microsoft.com/en-us/windows/win32/seccng/cng-portal.

  2. Similar question raised here, with the closest answer: https://crypto.stackexchange.com/questions/39566/where-do-windows-applications-get-entropy-from

Improve this answer
1
  • That only describes the API. I'm asking about the sources the kernel uses to collect entropy.
    – forest
    Mar 11, 2022 at 21:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.