2

I noticed that when reading from /dev/random, I have a very real impact on the entropy available on my linux box.

(reading from /proc/system/kernel/random/entropy_avail),

Yet when reading from /dev/urandom, (I understand seeded by real entropy but actually a CSPRNG), I can generate high quality entropy data, but my entropy_avail doesn't drop...

How is this possible, or am I missing something?

  • 2
    That's intended behavior. You should probably use urandom since you'll have lots of entropy starvation issues if you try to use random for anything serious. – user Dec 11 '19 at 14:06
  • Also see this question. – user Dec 11 '19 at 14:07
  • thanks but how can /dev/urandom provide high quality entropy without actually USING entropy? @user – Woodstock Dec 11 '19 at 15:13
  • 1
    It uses seed data from /dev/random and uses a (probably) secure CSPRNG to generate arbitrary amounts of data from it. I believe it gets periodically reseeded from system entropy, but don't quote me on that. – user Dec 11 '19 at 15:17
  • thanks if you want to add this as an answer, I will mark as correct @user – Woodstock Dec 11 '19 at 15:18
1

/dev/urandom uses a CSPRNG (Chacha20 last time I checked) to generate a stream of random data from an initial seed and allows the user to read an arbitrary number of bits from it. /dev/random pulls data out of a random pool that needs to be replenished.

It is possible to read from /dev/urandom before the system has enough entropy to provide a secure stream of data, in which case the kernel log should show a warning about an uninitialized read from it. If this is a concern, for example in embedded systems, then you'll need to use a hardware random number generator to generate additional entropy before you let programs start using it.

Provided the system gathered enough entropy, you'll get cryptographically secure random data from urandom and information theoretically secure data from random. If you're using a non-information-theoretically-secure encryption scheme or you're not generating vast quantities of encryption keys, then you might as well just use urandom.

You shouldn't read from /dev/random or /dev/urandom directly since the kernel exposes a nice getrandom system call that you can use in your programs, and it will help you avoid some pitfalls when trying to read from the character devices directly.

This answer has additional details about the differences between the two RNG devices.

|improve this answer|||||
  • thanks a lot @user – Woodstock Dec 11 '19 at 15:38
  • 1
    @Woodstock No problem. I'll add in a bit about potential issues with low entropy reads from urandom. – user Dec 11 '19 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.