0
$\begingroup$

I am thinking about running the following linux command on each boot to generate a new random token each boot.

printf '%s' "$RANDOM"`ps -e` | md5sum | cut -d ' ' -f 1
  • The first part takes a string from the shell's $RANDOM variable and then from ps -e snapshot of every running process and PID at the moment.

  • The second hashes the string.

  • The last part simply cleans up the string by removing the trailing space-dash outputted with the hash.

Is this enough to generate a quick random string with enough entropy?

$\endgroup$
4
  • 4
    $\begingroup$ Enough entropy for what? Why not just use /dev/urandom? $\endgroup$
    – bkjvbx
    Dec 20 '16 at 8:58
  • 5
    $\begingroup$ Neither $RANDOM nor PIDs are a cryptographically secure source of random numbers. $\endgroup$
    – bkjvbx
    Dec 20 '16 at 9:04
  • 1
    $\begingroup$ What are you using the string for? You say "random token" but don't explain the attributes of the token. In any case, this looks like a very weak source of entropy, one I wouldn't recommend for security purposes. As @bkjvbx said, just use /dev/urandom, which is exactly what it's for. $\endgroup$ Dec 20 '16 at 20:49
  • $\begingroup$ Thanks. Is $RANDOM weaker than /dev/urandom? $\endgroup$ Dec 20 '16 at 23:40
2
$\begingroup$

No, it doesn't; not unless you want to have $2^{15}$ bits of non-cryptographically secure random token - the output of the $RANDOM function of bash.

How PID's are created depends on the operating system. The only other information is the starting time really. Neither of those can be seen as random and is easy to guess and even to influence.

There have been some proposed patches to make PID's more random in Linux but they were rejected by the kernel maintainers. They are kind of chicken-egg anyway; to create random ID's the kernel would need to have a good random number generator which you could employ yourself.

$\endgroup$
3
  • 1
    $\begingroup$ Relying on bash during boot time is horrific as well, in my opinion. $\endgroup$
    – Maarten Bodewes
    Dec 20 '16 at 18:45
  • $\begingroup$ So would using /dev/urandom be better or $RANDOM would be better? $\endgroup$ Dec 20 '16 at 23:38
  • 1
    $\begingroup$ /dev/urandom absolutely would trump $RANDOM when it comes to cryptography. $\endgroup$
    – Maarten Bodewes
    Dec 20 '16 at 23:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.