1

Approximately how many bits of entropy are contained in each byte read from /dev/random and /dev/urandom? Data from /dev/random uses the kernel random-number generator while /dev/urandom uses a CPRNG so although the number of bytes read from each may be identical, the amount of actual entropy read from each would not be identical.

Are there any best practices and/or studies estimating how much entropy is generally contained in each byte of data read from these sources?

For example, if I needed 80 bits of entropy for a secure token, and the token was being generated by reading data from dev/urandom, and if I knew that each byte of data read from /dev/urandom would contain approximately 4 bits of entropy, I could read 20 bytes of data and use a hash function to generate the token.

3

So long as the CPRNG was ever properly seeded, /dev/random and /dev/urandom have no detectable differences in behavior. It's like the difference between water and holy water -- there's a difference in the way you make them, but no test can tell one from the other.

There is no point in getting more bytes of data from a single CPRNG and hashing them. That's precisely what the CPRNG already does internally.

  • Thanks for the clarification! Do you know any references discussing /dev/random vs /dev/urandom? – Daniel Kauffman Jan 2 '15 at 2:33
  • The hash in this case is just an easy way to generate a fixed length hex digest. – Daniel Kauffman Jan 2 '15 at 2:36
  • @DanielKauffman You can already read however many bytes you want/need from /dev/urandom directly. Hashing is really only helpful if you want to combine entropy from multiple sources. – David Schwartz Jan 2 '15 at 2:57
  • Data from /dev/urandom includes bytes 0-255 and encoding that data using a hex digest is one way to get the data into a format that plays well with other applications. – Daniel Kauffman Jan 2 '15 at 3:24
  • @DanielKauffman I have no idea what that means. – David Schwartz Jan 2 '15 at 3:27
2

The man page man 4 random contains quite a lot of useful information about /dev/random and /dev/urandom.

If I understand it correctly, the idea is that as long as the overall entropy in your system is high enough, it does not matter: taking more data from /dev/urandom than there was entropy should not be a problem, since making use of the fact that the "actual entropy" in for example 2000 bits you use is only 512 bits would require to break the CPRNG or guess the 512 bits, which is still way more than can ever be done by brute-force methods.

If you actually want to measure the effect of using data from any of these two devices on the entropy pool, you can read the content of /proc/sys/kernel/random/entropy_avail, which contains the current number of bits of entropy:

cat /proc/sys/kernel/random/entropy_avail

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.