[lkml]   [2003]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: /dev/random broken?
On Sat, 2003-06-28 at 19:10, Justin Pryzby wrote:

> /dev/urandom is what you want; it makes up its own entropy. /dev/random
> uses entropy from user input (low order bits I imagine). I assume that
> this is how other unixes work, too.

Actually, no. Both device files use entropy from the same location (the
entropy pool), which is derived from the same sources (various interrupt
timings and whatnot).

The difference between the two is that /dev/random keeps track of the
inherent entropy in the pool and will block when the entropy grows too
small. This is done as protection against any possible flaws in the
one-way hash employed on outgoing data. Theoretically, if someone was
able to break SHA-1, and they obtained a sufficiently large percentage
of the output data, they could theoretically determine some theoretical
state about the entropy pool. To prevent this theoretical attack,
/dev/random will not return any data while the entropy estimate is not
positive. This ensures there is enough entropy in the pool such that,
even if a single attacker has seen all the output thus far, they cannot
learn of the pool's state.

Also, as far as other Unix systems, I think /dev/random was first in
Linux. I know Mac OS X has /dev/random and /dev/urandom, but they both
behave like Linux's /dev/urandom.

Robert Love

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:38    [W:0.050 / U:1.928 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site