pem, a JS wrapper around openssl, has the following code in it:

var params = ['genrsa',

Am I correct in thinking that that is an improper usage of the -rand option (poor entropy = bad seed for random number generator)?

Cause this dude just closed the issue thinking it's OK, and if he's wrong, it'd be nice if someone could explain in better detail than I can why what he is doing is unsafe.

If I'm mistaken and it is safe, I'd be curious to hear why.

Thanks Cryptography StackExchange!


1 Answer 1


I ran the command under dtruss on OSX, with it pointing to a static file. Even then, it appears to use this as an additional source of randomness to /dev/urandom.

It's distasteful and almost certainly pointless. But assuming it only mixes the data into an already cryptographically-secure source of randomness, it's not actively harmful. That said, I can only see the syscalls being made — it's possible this is not what's happening at all under the hood.

  • $\begingroup$ Thanks for doing that. I'm not marking your answer as correct since it's not definitive, but I gave ya an upvote for investigating! Thank you! :) $\endgroup$
    – Greg
    Mar 1, 2015 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.