0
$\begingroup$

I am thinking about running the following linux command on each boot to generate a new random token each boot.

printf '%s' "$RANDOM"`ps -e` | md5sum | cut -d ' ' -f 1

  • The first part takes a string from the shell's $RANDOM variable and then from ps -e snapshot of every running process and PID at the moment.

  • The second hashes the string.

  • The last part simply cleans up the string by removing the trailing space-dash outputted with the hash.

Is this enough to generate a quick random string with enough entropy?

Improve this question
$\endgroup$
4
  • 4
    $\begingroup$ Enough entropy for what? Why not just use /dev/urandom? $\endgroup$
    – bkjvbx
    Commented Dec 20, 2016 at 8:58
  • 5
    $\begingroup$ Neither $RANDOM nor PIDs are a cryptographically secure source of random numbers. $\endgroup$
    – bkjvbx
    Commented Dec 20, 2016 at 9:04
  • 1
    $\begingroup$ What are you using the string for? You say "random token" but don't explain the attributes of the token. In any case, this looks like a very weak source of entropy, one I wouldn't recommend for security purposes. As @bkjvbx said, just use /dev/urandom, which is exactly what it's for. $\endgroup$
    – John Deters
    Commented Dec 20, 2016 at 20:49
  • $\begingroup$ Thanks. Is $RANDOM weaker than /dev/urandom? $\endgroup$
    – Joseph Shih
    Commented Dec 20, 2016 at 23:40

1 Answer 1

Reset to default
2
$\begingroup$

No, it doesn't; not unless you want to have $2^{15}$ bits of non-cryptographically secure random token - the output of the $RANDOM function of bash.

How PID's are created depends on the operating system. The only other information is the starting time really. Neither of those can be seen as random and is easy to guess and even to influence.

There have been some proposed patches to make PID's more random in Linux but they were rejected by the kernel maintainers. They are kind of chicken-egg anyway; to create random ID's the kernel would need to have a good random number generator which you could employ yourself.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ Relying on bash during boot time is horrific as well, in my opinion. $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 20, 2016 at 18:45
  • $\begingroup$ So would using /dev/urandom be better or $RANDOM would be better? $\endgroup$
    – Joseph Shih
    Commented Dec 20, 2016 at 23:38
  • 1
    $\begingroup$ /dev/urandom absolutely would trump $RANDOM when it comes to cryptography. $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 20, 2016 at 23:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.