<story><title>New and improved Linux Random Number Generator ready for testing</title><url>https://portswigger.net/daily-swig/secure-development-new-and-improved-linux-random-number-generator-ready-for-testing</url></story><parent_chain></parent_chain><comment><author>salmo</author><text>This is something that has frustrated me for years.  There has been no interest in modernizing the Linux PRNG really ever.  This article doesn&amp;#x27;t go into more depth so I don&amp;#x27;t know if it&amp;#x27;s just tacking on more entropy sources and algorithm support or a real modernization.&lt;p&gt;Windows, MacOS, every BSD, Solaris, etc. have moved past the (blocking) &amp;#x2F;dev&amp;#x2F;random vs &amp;#x2F;dev&amp;#x2F;urandom to more mathematically sound solutions.  (Seriously, measuring entropy?) But Torvalds, Ts&amp;#x27;o, etc. have blocked, belittled, or ignored any movement there.&lt;p&gt;It&amp;#x27;s crazy that the OS that runs all the things essentially has a roll-your-own-crypto PRNG at its core rather than relying on actual experts for that.&lt;p&gt;Unfortunately, it&amp;#x27;s &amp;quot;good enough&amp;quot; to not HAVE to change.  Use &amp;#x2F;dev&amp;#x2F;random sparingly to seed your own PRNG, change your Java config to use &amp;#x2F;dev&amp;#x2F;urandom, or (shudder) use rngd to make it seed itself.&lt;p&gt;At least once a year I hit some COTS product that craps itself under load blocking on &amp;#x2F;dev&amp;#x2F;random on a VM, causing an outage.  Yes, it&amp;#x27;s a &amp;quot;worked on my laptop&amp;quot; problem, but an unnecessary rake to leave out in the garden.</text></comment>
<story><title>New and improved Linux Random Number Generator ready for testing</title><url>https://portswigger.net/daily-swig/secure-development-new-and-improved-linux-random-number-generator-ready-for-testing</url></story><parent_chain></parent_chain><comment><author>strenholme</author><text>There is a lot said for making the Linux random number generator configurable. A good entropy (random number) source takes entropy from a number of different sources and combines it with a cryptographic strong algorithm: Either a strong hash whose output is made the key and IV for a stream cipher, or directly using an Extendable-Output Function (XOF) such as a cryptographic sponge. [1]&lt;p&gt;For example, there is some controversy with the RDRAND (the x86 ”give me random bits” op code) operation, with concerns that maybe the numbers weren’t truly random, and at least one known security hole where the RDRAND output could leak under some circumstances.  However, it’s widely available and probably makes good random bits.  However, if it doesn’t, we want other sources of entropy (microphone output low bits, interrupt timings, etc.) so &amp;#x2F;dev&amp;#x2F;random or &amp;#x2F;dev&amp;#x2F;urandom still gives us strong entropy even if RDRAND is completely busted.&lt;p&gt;[1] I personally think a cryptographic sponge is ideal for this, since sponge functions have absorb, output, and duplex (absorb after output, i.e. accept new entropy from the system after outputting bits) functionality</text></comment>