2uo.de

I'd recommend the second, too, at least: https://www.2uo.de/Books/wool/

This is the best explanation of this issue that i know of: https://www.2uo.de/myths-about-urandom

http://www.2uo.de/myths-about-urandom/ explains the issue well, but I hestitate to recommend it becuase it uses that horrid "Myth: Fact" antipattern (with the Myths in bold!) that has the psychological effect of making the reader remember the false statements and come away with the wrong memories. I recommend copy-pasting the document, deleting all the "myth" garbage, and reading the explanations.

/dev/random is a PRNG, and predictable. You shouldn't use it for security applications but only for specific state/algorithm randomness. /dev/urandom requires hardware noise/key events, etc. to generate its entropy. These become hard to find when your dealing with purely virtualized installations. This is not true, at least on Linux. /dev/random is actually closer to what you describe as /dev/urandom. It is a cryptographically strong randomness source that blocks depending on the state of its internal "entropy pool". /dev/urandom is also a cryptographically strong randomness source (seeded from /dev/random), but it does not block. Here's a great blog post with more info: http://www.2uo.de/myths-about-urandom/

> this slightly time-saving but potentially dangerous choice? The one and only danger is during the machine's boot process, because while /dev/random and /dev/urandom use the same data: * on linux /dev/random has a silly and unfounded entropy estimator and will block at arbitrary points (used to be a fad at some point, but cryptographers have sworn off it e.g. Yarrow had an entropy estimator but Fortuna dropped it) * also on linux, /dev/urandom never blocks at all, which includes a cold start, which can be problematic as that's the one point where the device might not be seeded and return extremely poor data In fact the second point is the sole difference between getrandom(2) and /dev/urandom. If you're in a steady state scenario (not at the machine boot where the cold start entropy problem exists) "just use urandom" is the recommendation of pretty much everyone: tptacek, djb, etc… https://www.2uo.de/myths-about-urandom/ https://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ http://blog.cr.yp.to/20140205-entropy.html (see bottom of page)

How does a blocking CSPRNG mitigate this attack? Again, it makes no sense to say that a CSPRNG can start "running low" on entropy. Here's what djb has to say about this: Cryptographers are certainly not responsible for this superstitious nonsense. Think about this for a moment: whoever wrote the /dev/random manual page seems to simultaneously believe that (1) we can't figure out how to deterministically expand one 256-bit /dev/random output into an endless stream of unpredictable keys (this is what we need from urandom), but (2) we _can_ figure out how to use a single key to safely encrypt many messages (this is what we need from SSL, PGP, etc.). For a cryptographer this doesn't even pass the laugh test. (Unless you're talking about the early boot seeding problem that /dev/urandom has on linux, which is a very real problem). For reference, here's the classic source I think you're referring to: https://www.2uo.de/myths-about-urandom

> Here's another article you can argue with: > http://www.2uo.de/myths-about-urandom/ Which backs up my point that using /dev/urandom blindly without knowing about some of the edge cases isn't a good idea, and lists those edge cases and what to do about them (which is what I suggested you do too). > And another: > http://security.stackexchange.com/questions/3936/is-a-rand-f... Which also lists the edge cases I'm talking about. Hey look if you just want to say "I'm aware of the edge cases and don't want to put them in my gist for others to see" that's fine with me, but dodging the issue by claiming there are no edge cases (and then listing 3 articles which all mention the edge cases) isn't the right reply I think. Don't be surprised if someone suggests that a gist listing security best practices list some edge cases that go along with the blind advice too. Feel free to disagree, but at least disagree honestly.

Do note that "exhausting the system's entropy pool" is a myth - entropy can't run out. In the bad old days, Linux kernel developers believed the myth and /dev/random would block if the kernel thought that entropy was low, but most applications (including crypto/rand) read from the non-blocking /dev/urandom instead. See https://www.2uo.de/myths-about-urandom/ for details. So don't let that stop you from using crypto/rand.Read!

Random numbers are used to generate your TLS certificate key or your SSH key. If one can predict how a TLS or SSH key was generated they could impersonate the key holder. Here is an explanation of what was possible when a Debian packager mistakenly introduced a patch which reduced the SSL certificate keyspace in 2008: https://jblevins.org/log/ssh-vulnkey The possibilities of keys which were generated by this random number generator was so small, that a brute-force attack on keys was feasible. That being said, for years, random number generators have been using random signals coming to your computer (key strokes, network packets, ...) and feeding them into a sponge function. You don't need lava lamps or pendulums to generate random numbers, it's just for the press. https://www.2uo.de/myths-about-urandom/

> https://www.2uo.de/myths-about-urandom/ Needs an update now, it contains numerous facts that are no longer true.

They already use the same CSPRNG algorithm; the only difference is the entropy accounting. See 2nd point here: https://www.2uo.de/myths-about-urandom/

From https://github.com/smuellerDD/jitterentropy-rngd > Using the Jitter RNG core, the rngd provides an entropy source that feeds into the Linux /dev/random device if its entropy runs low. It updates the /dev/random entropy estimator such that the newly provided entropy unblocks /dev/random. This is a red flag. Entropy doesn't run low. https://www.2uo.de/myths-about-urandom I'm calling it now: Don't use VeraCrypt. They made a very questionable decision based on the sort of ignorance that leads people to use /dev/random and haveged rather than RtlGenRandom (Windows), getrandom(2) (new Linux), or /dev/urandom (old Linux). Cryptography engineering requires care and this sort of ignorance tends to undermine secure implementations.

There's no way to "use up" your entropy; this is a persistent myth that's been hanging around the Linux world for a very long time. * https://www.2uo.de/myths-about-urandom/#what-about-entropy-running-low * https://www.mail-archive.com/[email protected]/msg04763.html

1. The official man page. The /dev/random interface is considered a legacy interface, and /dev/urandom is preferred and sufficient in all use cases, with the exception of applications which require randomness during early boot time; for these applications, getrandom(2) must be used instead, because it will block until the entropy pool is initialized. 2. https://www.2uo.de/myths-about-urandom/

> If you are even more like me, you will think that this is like the difference between /dev/urandom and /dev/random /dev/urandom does not produce such non-random results; the comparison is rather far-fetched. /dev/urandom is suitable for virtually all tasks, including cryptography[1]. It's the same as /dev/random on various BSDs, even. [1] https://www.2uo.de/myths-about-urandom/

Then you might find that Thomas Hühn's approach helps you. * https://www.2uo.de/myths-about-urandom/ The "another crypto expert" mentioned by schoen is Daniel J. Bernstein, quoted directly by Hühn.

Expanding on this, for anyone who wants to read more, http://www.2uo.de/myths-about-urandom/ is a good resource.

the preference for "blocking" /dev/random is one of these crypto-urban myths that is almost dispelled by now: https://www.2uo.de/myths-about-urandom/

Quite a long read, but I think it explains the situation quite well: https://www.2uo.de/myths-about-urandom/

Here's another article you can argue with: http://www.2uo.de/myths-about-urandom/ And another: http://security.stackexchange.com/questions/3936/is-a-rand-from-dev-ur…

https://www.kickstarter.com/projects/moonbaseotago/onerng-an-open-sour… It's a ~$50 USB dongle, opensource and available for shipping. Anecdotally, I personally used it for an RF project that need uniform randomness and exhausted /dev/random on the target hardware. It worked fine, if a bit slow for my very specific usecase. That said, if you want to go even cheaper, seriously consider if you can just stick with /dev/urandom. See http://www.2uo.de/myths-about-urandom/ for an interesting read on why that might just work.

What do you mean by "use up the nice entropy"? You can use /dev/urandom for cryptographic applications (in fact _you should_). Here's a nice article about it: http://www.2uo.de/myths-about-urandom/

Use /dev/urandom instead of /dev/random http://www.2uo.de/myths-about-urandom/

I've heard that reading from /dev/random tends to "steal" entropy from /dev/urandom or something. I'm not sure. But if you only use urandom, you're safe. Here, from a quick search: http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ http://www.2uo.de/myths-about-urandom/

This would also quiet a lot of the noise around the entropy estimation blocking in `/dev/random`. I mean, if basically everyone [1] agrees that you should just use `/dev/urandom/` because blocking on entropy estimation is misguided, then why not copy the behavior of every other Unix? [1]: http://www.2uo.de/myths-about-urandom/

For an explanation of the voodoo nature of the blocking /dev/random, see: http://www.2uo.de/myths-about-urandom/ EDIT: or read tptacek's root comment on this very page.

> If you're a level 500 elite hacker like I am, you will note that the cryptographic quality of numbers from /dev/urandom is not the same as numbers from /dev/random. In our case, we don't want this operation to block, so we use /dev/urandom. This is wrong. See http://www.2uo.de/myths-about-urandom/ (The part about /dev/urandom not blocking is right though) Edit: changed http://security.stackexchange.com/questions/3936/is-a-rand-from-dev-ur… to the current link, since the current link is more to the point.

In the immortal words of Timecube: "You have been educated stupid". Fortunately, salvation is readily at hand: http://www.2uo.de/myths-about-urandom/

There's a lot of misinformation and cargo cult crypto programming, but the basic summary is that /dev/random information-theoretic security is unnecessary for most applications, but necessary for being able to know that you can produce every possible permutation of a deck of cards. http://www.2uo.de/myths-about-urandom/

That blog post is old and inaccurate. It propagates myths about CSPRNGs that some have been trying to dispel, particularly Thomas Hühn [1] and djb [2]. /dev/urandom is the same cryptographically secure PRNG as /dev/random, except that /dev/random will superstitiously block when it thinks entropy has been "consumed". (CSPRNGs do not meaningfully "consume" entropy.) If you use /dev/random for the mythical warm fuzzies, you might also be misunderstanding other things. Don't be superstitious. Use /dev/urandom. [1] http://www.2uo.de/myths-about-urandom/ [2] http://www.mail-archive.com/[email protected]/msg04763.html