3

On Linux, it is possible for userspace to mix arbitrary data with the kernel entropy pool by writing to the /dev/urandom device. Is there any equivalent on Windows which does not require SYSTEM?

4
  • Can you expand on what you mean by "does not require SYSTEM" ?
    – Limit
    Commented Apr 25, 2018 at 1:54
  • I ask because I found this particular link social.msdn.microsoft.com/Forums/windowsdesktop/en-US/… which may or may not be useful to you based on what you mean by system
    – Limit
    Commented Apr 25, 2018 at 1:54
  • 3
    @Limit SYSTEM is a high privilege context, similar to root on Linux. I believe there are ways to register a new driver that acts as an RNG, but that is not what I am looking for because it requires these privileges. That link seems to describe replacing the system RNG with your own provider, which is not what I want.
    – forest
    Commented Apr 25, 2018 at 1:55
  • I see. Sure! Makes sense
    – Limit
    Commented Apr 25, 2018 at 2:30

1 Answer 1

4

None that I know of, exactly. CryptGenRandom (the legacy CryptoAPI CSPRNG function) allows callers to supply additional entropy, but it's not even clear if this affects future calls to CryptGenRandom by the same process, and it's fairly clear it doesn't affect other processes.

BCryptGenRandom (the next-gen replacement for the old CryptGenRandom) used to allow the caller to supply addition entropy in much the same way, using the BCRYPT_RNG_USE_ENTROPY_IN_BUFFER flag, but that is no longer supported as of Win8. Even in Vista and Win7 (and Server 2008), though, it is unclear whether the data supplied with that flag only modified the data returned by that call, or that call and future results to calls from the same process, or future results for all callers.

3
  • ...it is unclear whether the data... This is what I wanted to clarify. Although this answer is enlightening, "it is unclear" doesn't really answer the question.
    – forest
    Commented May 19, 2018 at 1:11
  • @forest Unfortunately, without access to the CAPI/CNG source code, and given the inherently random nature of the API, the only way to know is to check the documentation, hear from somebody who wrote it, or use decompilation. I once knew some people in CNG, but it was some time ago and I've lost touch; I'm somewhat interested in the decompilation but not deeply enough to do it myself right now, and the only documentation available is what I provided. Sorry...
    – CBHacking
    Commented May 20, 2018 at 19:20
  • Oh well. At least it's some information to go on. It would probably be possible to write to the registry random seed to affect the pool at next boot, but that of course would require being Administrator.
    – forest
    Commented May 21, 2018 at 0:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .