Linux has the familiar problem that /dev/random blocks too much (insisting on being information-theoretically secure), while /dev/urandom doesn't block enough (it will return data before it's been adequately seeded). The new
getrandom() system call does the Right Thing, but as of this writing it's not yet universally available in the major distros.
My question is: if I succeed at reading a single byte from /dev/random, does this imply that /dev/urandom is seeded? I've spent some time staring at http://lxr.free-electrons.com/source/drivers/char/random.c but haven't been able to figure this out. Entropy provided by device drivers gets mixed into the input pool, then the input pool feeds separate
/dev/urandom output pools, but I can't glean the conditions which trigger transfers from the input pool to the output pools, or (consequently) whether it's possible for /dev/random to be fed while /dev/urandom starves.
getrandom()was written to address, is that it will return data even before that, which is a hazard for any code that might run early in the boot process. For code that has this concern, the cleanest solution is to use
getrandom(), but I'm investigating the soundness of "select() on /dev/random before reading from /dev/urandom" as an alternative approach for older systems. $\endgroup$