4

I noticed that when reading from /dev/random, I have a very real impact on the entropy available on my linux box.

(reading from /proc/system/kernel/random/entropy_avail),

Yet when reading from /dev/urandom, (I understand seeded by real entropy but actually a CSPRNG), I can generate high quality entropy data, but my entropy_avail doesn't drop...

How is this possible, or am I missing something?

Improve this question
5
  • 2
    That's intended behavior. You should probably use urandom since you'll have lots of entropy starvation issues if you try to use random for anything serious.
    – user
    Commented Dec 11, 2019 at 14:06
  • Also see this question.
    – user
    Commented Dec 11, 2019 at 14:07
  • thanks but how can /dev/urandom provide high quality entropy without actually USING entropy? @user
    – Woodstock
    Commented Dec 11, 2019 at 15:13
  • 1
    It uses seed data from /dev/random and uses a (probably) secure CSPRNG to generate arbitrary amounts of data from it. I believe it gets periodically reseeded from system entropy, but don't quote me on that.
    – user
    Commented Dec 11, 2019 at 15:17
  • thanks if you want to add this as an answer, I will mark as correct @user
    – Woodstock
    Commented Dec 11, 2019 at 15:18

1 Answer 1

Reset to default
2

/dev/urandom uses a CSPRNG (Chacha20 last time I checked) to generate a stream of random data from an initial seed and allows the user to read an arbitrary number of bits from it. /dev/random pulls data out of a random pool that needs to be replenished.

It is possible to read from /dev/urandom before the system has enough entropy to provide a secure stream of data, in which case the kernel log should show a warning about an uninitialized read from it. If this is a concern, for example in embedded systems, then you'll need to use a hardware random number generator to generate additional entropy before you let programs start using it.

Provided the system gathered enough entropy, you'll get cryptographically secure random data from urandom and information theoretically secure data from random. If you're using a non-information-theoretically-secure encryption scheme or you're not generating vast quantities of encryption keys, then you might as well just use urandom.

You shouldn't read from /dev/random or /dev/urandom directly since the kernel exposes a nice getrandom system call that you can use in your programs, and it will help you avoid some pitfalls when trying to read from the character devices directly.

This answer has additional details about the differences between the two RNG devices.

Improve this answer
1
  • 1
    @Woodstock No problem. I'll add in a bit about potential issues with low entropy reads from urandom.
    – user
    Commented Dec 11, 2019 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .