2
$\begingroup$

My understanding of how /dev/urandom works is that the kernel collects true randomness from a variety of sources, and mixes them together to remove statistical bias. It does this at regular intervals to refresh the entropy pool.

The CSPRNG then takes a subset of these bits to generate random bits for consumption.

My question: in the course of dipping into the entropy pool, does the CSPRNG also update the entropy pool or is that done only by the OS?

$\endgroup$
1
$\begingroup$

The CSPRNG is updated from the input pool from time to time (at most every 5 minutes by default). It does not feed back into the input pool since it is derived entirely from it in the first place.

Prior to 4.8, the input pool would periodically feed into the blocking pool and non-blocking pool at long enough intervals to provide a "catastrophic reseed" that mixes in enough entropy that it could not be brute forced even given knowledge of the prior state. These two pools were identical, with the exception that the blocking pool would track entropy estimates and block if the estimate drops too low. Since 4.8, the non-blocking pool has been replaced by a CSPRNG based on the ChaCha20 stream cipher.

random driver

From Documentation and Analysis of the Linux Random Number Generator, version 2.5

$\endgroup$
  • $\begingroup$ So if I understand correctly, in 4.8 onwards, the entropy pool is refreshed only by the OS. The CSPRNG (ChaCha20) sources its seed from this pool to generate its random bits. Periodically, the CSPRNG will renew its seed from this pool. But at no time will the CSPRNG actually operate on the pool in any way. Is that correct? $\endgroup$ – Bastien Jan 25 at 13:43
  • $\begingroup$ @Bastien Correct. The CSPRNG is only used when extracting random data in a non-blocking way (though it can also be used to seed another CSPRNG on NUMA systems where there's one copy per node). $\endgroup$ – forest Jan 26 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.