Item — HN Reader

That's exactly the wrong advice.

You should always use /dev/urandom on Linux for cryptographic use, unless you know exactly why you need /dev/random. Hint: you don't.

(On FreeBSD it doesn't matter because it's all the same)

I've been meaning to write up a coherent summary of that issue with all kinds of sources forever now, and I should really get around to just doing it, because this comes up every few weeks on HN.

1 comments

I have no idea why you would use /dev/urandom over /dev/random, or vice versa. If you can write something, I would be very grateful.

The short version is as follows: /dev/random is basically the entropy pool. There isn't much data in there and whatever lands in it must be carefully chosen to prevent entropy going down (Debian accidentally broke that part a few years ago). Since there isn't much data you probably shouldn't take too much of it when you can help it because if it runs out, it blocks until there is enough entropy back in the pool.

/dev/urandom on the other hand is a CSPRNG that is regularly re-seeded from /dev/random. The purpose is to stretch the avilable entropy to more (pseudo-)random numbers. Since it's a CSPRNG the sequence is deterministic but impractical to predict, re-seeding helps in preventing others from observing too much output to reverse-engineer the seed.

So advice is generally to only use /dev/random when you're implementing something like /sev/urandom and for SSL keys and the like you just use /dev/urandom.

No, no, no, no.

/dev/random and /dev/urandom are two interfaces to essentially the same CSPRNG.

On Linux, unlike FreeBSD (where there is no difference between the two), there are two differences between random and urandom:

(1) random will block when a kernel entropy estimator indicates that too many bytes have been drawn from the CSPRNG and not enough entropy bytes have been added to it

(2) urandom and random pull from separate output pools (both of which receive the same entropy input, and both of which are managed the same way).

It is not true that /dev/urandom is a PRNG and /dev/random is not; it is not true that /dev/random is a CSPRNG and /dev/urandom is just a PRNG. They are the same thing, with a extremely silly policy difference separating them.

Thanks to both of you for responding. I will need to read more to understand in detail, but you have at least given me some pointers.

I stand corrected, then.

The Debian accident was related to the openssl PRNG, not the kernel's.