<story><title>BoringSSL</title><url>https://www.imperialviolet.org/2015/10/17/boringssl.html</url></story><parent_chain><item><author>ghshephard</author><text>&lt;i&gt;&amp;quot;Random number generation in OpenSSL suffers because entropy used to be really difficult. There were entropy files on disk that applications would read and write, timestamps and PIDs would be mixed into entropy pools and applications would try other tricks to gather entropy and mix it into the pool. That has all made OpenSSL complicated.&lt;p&gt;BoringSSL just uses urandom—it&amp;#x27;s the right answer. (Although we&amp;#x27;ll probably do it via getrandom rather than &amp;#x2F;dev&amp;#x2F;urandom in the future.) There are no return values that you can forget to check: if anything goes wrong, it crashes the address space.&amp;quot;&lt;/i&gt;&lt;p&gt;There is a meme that pops up from time to time on HN, that &amp;quot;&amp;#x2F;dev&amp;#x2F;urandom is okay for stretching out random data but not sufficient for random seeds&amp;quot;, that I&amp;#x27;ve never understood.  tptacek seems to be consistent in suggesting, &amp;quot;Just use &amp;#x2F;dev&amp;#x2F;urandom.  Period.&amp;quot;  And it looks like people who also have a lot on the line concur.&lt;p&gt;If this is the case, I&amp;#x27;m wondering if we&amp;#x27;ll see a day when gpg might migrate from &amp;#x2F;dev&amp;#x2F;random to &amp;#x2F;dev&amp;#x2F;urandom?</text></item></parent_chain><comment><author>zaroth</author><text>It&amp;#x27;s just &amp;quot;because entropy used to be really difficult!&amp;quot; We now have relatively simple and proven algorithms (Yarrow, Fortuna) which can take 256-bits of entropy, and deliver effectively infinite streams of high quality entropy from that core without leaking any of the seed, or skewing the output. In such a system, pulling bits out of the core entropy bucket is counter-productive.&lt;p&gt;As djb says;&lt;p&gt;&lt;pre&gt;&lt;code&gt;  Cryptographers are certainly not responsible for this superstitious
  nonsense. Think about this for a moment: whoever wrote the &amp;#x2F;dev&amp;#x2F;random
  manual page seems to simultaneously believe that

    (1) we can&amp;#x27;t figure out how to deterministically expand one 256-bit
    &amp;#x2F;dev&amp;#x2F;random output into an endless stream of unpredictable keys (this
    is what we need from urandom), but

    (2) we _can_ figure out how to use a single key to safely encrypt many
    messages (this is what we need from ssl, pgp, etc.).

  For a cryptographer this doesn&amp;#x27;t even pass the laugh test.

&lt;/code&gt;&lt;/pre&gt;
BSD and OS X are more modern than Linux in their choice of CS-PRNG; they used to use Yarrow, and then added Fortuna support in 2014 (behind a config flag) and will make it default in 11.0. Linux has used largely the same CS-PRNG for &amp;#x2F;dev&amp;#x2F;urandom since 1994, with some upgrades to their mixing function, to prevent DoS against &amp;#x2F;dev&amp;#x2F;random, and upgraded recently to include random bytes extracted from &amp;quot;RDRAM&amp;quot; provided by Intel CPUs.&lt;p&gt;I&amp;#x27;m not sure why we haven&amp;#x27;t seen the underlying CS-PRNG switched wholesale to Fortuna in Linux. For example, they are still using a SHA-1 based output hash, which seems like it might be time for that to go.&lt;p&gt;The higher level take-away is that trying to avoid the modest code complexity of the CS-PRNG by going directly to &amp;#x2F;dev&amp;#x2F;random is more likely to lead to an exploitable catastrophic failure than sticking with &amp;#x2F;dev&amp;#x2F;urandom.</text></comment>
<story><title>BoringSSL</title><url>https://www.imperialviolet.org/2015/10/17/boringssl.html</url></story><parent_chain><item><author>ghshephard</author><text>&lt;i&gt;&amp;quot;Random number generation in OpenSSL suffers because entropy used to be really difficult. There were entropy files on disk that applications would read and write, timestamps and PIDs would be mixed into entropy pools and applications would try other tricks to gather entropy and mix it into the pool. That has all made OpenSSL complicated.&lt;p&gt;BoringSSL just uses urandom—it&amp;#x27;s the right answer. (Although we&amp;#x27;ll probably do it via getrandom rather than &amp;#x2F;dev&amp;#x2F;urandom in the future.) There are no return values that you can forget to check: if anything goes wrong, it crashes the address space.&amp;quot;&lt;/i&gt;&lt;p&gt;There is a meme that pops up from time to time on HN, that &amp;quot;&amp;#x2F;dev&amp;#x2F;urandom is okay for stretching out random data but not sufficient for random seeds&amp;quot;, that I&amp;#x27;ve never understood.  tptacek seems to be consistent in suggesting, &amp;quot;Just use &amp;#x2F;dev&amp;#x2F;urandom.  Period.&amp;quot;  And it looks like people who also have a lot on the line concur.&lt;p&gt;If this is the case, I&amp;#x27;m wondering if we&amp;#x27;ll see a day when gpg might migrate from &amp;#x2F;dev&amp;#x2F;random to &amp;#x2F;dev&amp;#x2F;urandom?</text></item></parent_chain><comment><author>eliteraspberrie</author><text>libgcrypt (GPG) does the same thing OpenSSL did. It uses &amp;#x2F;dev&amp;#x2F;random to seed an internal PRNG. But you can switch to using just the system PRNG:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    gcry_control(GCRYCTL_SET_PREFERRED_RNG_TYPE, GCRY_RNG_TYPE_SYSTEM);
&lt;/code&gt;&lt;/pre&gt;
I don&amp;#x27;t know if they would be convinced to use &amp;#x2F;dev&amp;#x2F;urandom though. They already rank &amp;#x2F;dev&amp;#x2F;random as having lower &amp;quot;security&amp;quot; than their own PRNG.</text></comment>