linux-kernel - Re: entropy of /dev/random vs. openssl rand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 28 Apr 2007 15:02:18 +0200
From:	Gisle Sælensminde 
	<Gisle.Salensminde@...s.uib.no>
To:	linux-crypto@...linux.org, linux-kernel@...r.kernel.org
Subject: Re: entropy of /dev/random vs. openssl rand

markus reichelt wrote:
> Hi,
>
> I need to create a moderate amount of v3 keys for loop-aes and wonder
> how/if the "openssl rand" implementation differs significantly from
> /dev/random concerning entropy.
>
> In case /dev/random and "openssl rand" are somewhat comparable, I
> would just use the latter to create the keys.
>
>   
Openssl actually uses /dev/urandom to generate random bytes on Linux and other systems that support it, possibly with some further filtering. On systems without a random device, a configuration file is used instead, since openssl is supposed to be compatible over a wide range of systems. Openssl rand should therefore be equivalent with the non-blocking /dev/urandom on Linux.

from openssl crypto/rand/rand_unix.c:

 /* Use a random entropy pool device. Linux, FreeBSD and OpenBSD
  * have this. Use /dev/urandom if you can as /dev/random may block
  * if it runs out of random entries.  */

> However, I certainly don't want to use a /dev/urandom look-alike.
>
>   

Whether the blocking behaviour of /dev/random is desirable is a matter of discussion. Some people argue that a periodically reseeded cryptographic-quality random number generator is as secure as a true random number generator for all practical purposes. It does then not make sense with a blocking generator like /dev/random. This view is much disputed, as can be seen if you read the archives of the Linux kernel mailing list. I personally can't think of any realistic scenario where /dev/random would make you safe while /dev/urandom would make you sorry. Some people seem to think differently, including you apparently  :-) , while the openssl people seem more concerned about the blocking behaviour of /dev/random. 

-Gisle

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/