4

There's a couple of programs that I've been using recently that ask you to type random keys as a source of randomness to seed an RNG for key generation.

Is this considered a good practice still, or is it better to rely on /dev/urandom and company as an entropy source?

  • 2
    These applications usually ask you to do this to provide additional entropy, in combination with the CSPRNG offered by your OS. – Polynomial Feb 26 at 23:39
  • By the time your operating system has gotten far enough in the boot process that you would be prompted to perform such a task, there's already more entropy in /dev/urandom than will ever be needed. At best, it does nothing. At worst, they mix that input with /dev/urandom themselves in a way that reduces the overally quality of the entropy. – Stephen Touset Feb 26 at 23:48
  • @StephenTouset Case #2 is more what I'm worried about (what if they're not using /dev/urandom at all, and this is the only source of entropy?) – Stack Tracer Feb 27 at 2:20
  • If they're not using /dev/urandom at all (everyone should use the getrandom syscall with flags = 0 if they can) then chances are good that they messed up their user space RNG implementation. I would assume they're not qualified to write cryptography related code. (Using just the output from getrandom/urandom is sufficient.) – Future Security Feb 27 at 3:46
  • I'm not convinced my keystrokes and my mouse movements add a noticeable amount of entropy compared to what my system finds on its own just from background processing happening on my system. And I try to keep my system as idle as feasible. – Ed Grimm Feb 27 at 3:56
2

Yes, but that's how you're getting randomness anyway. In Linux and most other operating systems, the exact time in nanoseconds that a key is pressed is recorded and injected into the entropy pool. This pool is used to seed the CSPRNG that powers /dev/urandom and other cryptographic random APIs.

The similar /dev/random character device is what we describe as blocking. It assumes that all used cryptographic functions are broken (a worst-case scenario) and so will only output randomness when it thinks it has "collected" enough entropy. When you type keys, the operating system uses that as a source of entropy and increases the entropy estimate, causing /dev/random to unblock. This speeds up the entropy collection by programs using that device. Now that doesn't mean that the program sare doing the right thing. They should have just used /dev/urandom which does not block and is still quite cryptographically secure. You should take a look at https://www.2uo.de/myths-about-urandom.

A related document on best practices for randomness generation is BCP 106.

  • Which thing are you answering "yes" to? Using keypresses for randomness is good enough, or it's not good enough? – Stack Tracer Apr 5 at 23:35
  • @StackTracer Yes to both. Generating random keys based on keystroke timing is proper, but that's how your OS does it already, so you can safely rely on /dev/urandom. So it is good enough, but you should use the built-in operating system API to do so. – forest Apr 5 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.