2

Let's take, for example, Linux. From my understanding, there are different sources and different ways that can be used to gather entropy (RNG daemon, Intel rrandr, TPM, etc). Some produce entropy that is of "better quality" than others. But, does it actually matter for a "normal" user?

(Let's say a user that only uses web browsers, office programs, and a password manager).

In which cases does the computer use entropy from the pool?

  • Does it uses it when browsing https websites?

  • Does it uses it when encrypting a file with 7zip or with a password manager?

|improve this question
3

For most cases, randomness quality is overrated.

Yes, it's important, can lead to some nasty consequences if done wrong, but there are so many easier mistakes that random quality would be at the end of your list of worries:

  • OS bugs
  • Browser bugs
  • Bad WiFi password
  • Password reuse
  • Default or hard-coded router passwords

The list is long. If you are affected by one of those, you lose. Exploiting the RNG to steal information is impractical if the attacker can exploit one of those issues. Breaking the RNG should be the last resort.

You must calculate the price to protect versus the information value. The attacker does the same. If you are not using the imperfect PRNG to protect something very valuable, you are good to go. Don't use it to generate a bank certificate, a Bitcoin wallet with a lot of coins, things like that.

Protecting a 7zip file or navigating using HTTPS will not be much more secure if you use a built-in PRNG or CloudFlare Lava Lamp RNG.

|improve this answer
  • So you confirm that simply browsing HTTPS websites will use the entropy pool ? Basically every encryption action on a PC uses it ? – puzzle Aug 10 '18 at 9:28
  • 1
    Every HTTPS handshake will use the pool once, to generate the symmetric key. Encryption will use the pool only when a random value is needed. Encrypting with a symmetric key don't use it, only the key generation does. – ThoriumBR Aug 10 '18 at 11:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.