Appeal to authority argument

######(A bit of side-thinking. Kids, learn to think properly and don’t do this at home!)

In the early 90’s when nobody really knew cryto, they invented random and urandom in Linux.

And then, after, BSD’s went “random is silly”. So they added a random device in BSD that does not block, just as urandom. they called it random. So, BSD’s random acts as Linux’s urandom, they are the same thing.

So, if nobody makes a fuss about BSD’s random not being secure, why make a fuss about Linux’s urandom?

#Conclusion

Linux’s urandom is fine as a CPRNG, use it. Don’t make a fuss about it.

Granted:

This is a bit of side-thinking for those “dummies” (such as me in the moment) that can’t/don’t want to learn cryptography but have desire to know which is correct to use: urandom or random. (disclaimer: you should learn crypto!). But now you maybe have something to point to them.

####But how similar is BSD’s random vs Linux’s urandom? Pretty similar in fact:

• In Linux, as soon as you’ve seen 128 bits of entropy for example, urandom is suitable as a CPRNG for all algorithms with a 128-bit security level, forever, as is random.

• In Linux, random blocks when the entropy pool has been depleted, and urandom does not block.

• In BSD, random waits until the pool is seeded, gets initialized, and then, it never blocks, just as Linux’s urandom.

So, Linux’s urandom never blocks, not even at the beginning to let the pool to be seeded and get correctly initialized. That’s a problem if you’re writing something that will run at early boot, like a server, or embedded platforms that don’t have such a seed (we might be talking about Linux on read-only disks, etc) as it is possible for urandom to get used when the pool was not seeded and return completely unseeded “random” data. If that is your case, just use the new getrandom syscall and you are good to go.

####What about man 4 random? It says otherwise! It has a typo.

##Disclaimer If you want to truly understand what this is all about, you could learn cryptography (which is not so bad, and quite interesting), or look elsewhere on the net. Examples: Thomas Hühn’s, or Thomas & Erin Ptacek from Matasano and their “use urandom”, “use urandom”, “use urandom”, “use urandom”, “use urandom”, “use urandom” quotes.