Noob question:

It is my understanding that the raw output from

  1. non-blocking /dev/random (where the kernel's entropy_avail estimate is equal to or greater than the number of random bits required)

    1. or properly-initialized /dev/urandom (i.e., after roughly 256 bits of entropy have been collected by the system)

can be used without further post-processing as strong keymat for long-term symmetric crypto keys.

The output is gathered thusly (for the symmetric key):

//output 256 bits of entropy in 64 hex digits
od -N 64 -x /dev/random

Is there any weakness in this method as I have been recently led to believe (with no justification other than 'it's common knowledge', supposedly), or is raw /dev/[u]random output usable for long-term (>10 year) keymat?

Edit: remove any reference to asymmetric crypto to make its own question.

  • $\begingroup$ It is suitable if you trust the underlying Linux implementation, which you usually can for the larger distros. You only want to seed your own user-land CSPRNG if you need large amounts of secret data quickly. $\endgroup$ – SEJPM Oct 12 '15 at 16:49
  • $\begingroup$ @otus the other question does indeed answer this one: 'Yes, raw /dev/random output is peachy, as long as you trust your Linux and its implementation'. I've lurked on this site for over a year and never ran across that one even after a 15-minute search for related questions before registering to post. I suppose I need to train in Google-fu. $\endgroup$ – Chrysostom Oct 12 '15 at 17:19
  • $\begingroup$ @Chrysostom, understandable, since the site search isn't very good. I couldn't find it from the duplicate search and had to go through my recent answers. $\endgroup$ – otus Oct 12 '15 at 17:24
  • $\begingroup$ Another relevant question: Proper way to generate symmetric keys $\endgroup$ – CodesInChaos Oct 12 '15 at 17:45
  • $\begingroup$ Thanks. I found another one which may be even more relevant (though it deals with the closed-source Windows CryptoAPI RNG) about halfway down the 'related' list of @CodesInChaos' answer: (crypto.stackexchange.com/questions/3332/…), which states that it is best to generate excess entropy and then hash it down with a suitable function. $\endgroup$ – Chrysostom Oct 12 '15 at 17:54