First of all, let me say I'm not at all a security expert.
As gpg key creation is using /dev/random
as random number generator, it is as secure on a virtual machine, as on a real machine.
/dev/random
is a blocking device, and will stop delivering any randomness beyond the available amount. You can check your available randomness by
cat /proc/sys/kernel/random/entropy_avail
(should be around 2000)
On a virtualmachine the available randomness is indeed lower than on a real machine, due to the lacking access to hardware.
You could increase the entropy by e.g. applying entropy keys and/or switch to a nonvirtualized machine.
There is a nice article available on entropy on virtual machines. Unfortunatly both parts of the article are only available in google cache right now.
Entropy has further effects on any ssl/tls encryption. So, using /dev/urandom
or any not-truly random source has indeed an impact on the security of your applications.
In terms of how reliable /dev/urandom
compared to true randomness is;
i'm not able to give you a decent answer there, sorry.
For further information about this topic you could go to http://security.stackexchange.com and/or read eg. this post