# How to generate a good symmetric secret key

I would like to generate a good secret key, that later will be used to encrypt data symmetrically. I am not sure how to generate a good secret key.

I use Linux, I am not sure which sources of enthropy there are. The idea now is the following: I can access current timestamp and seed with it PRNG to get some pseudo random value R. Feed this R into some KDF, for example HKDF and use the result as a symmetric key. Are there are some loopholes in such scheme?

• What is your environment? – kelalaka Mar 15 '19 at 9:19
• Why not simply generate the key on a PC and hard-code it? – Paul Uszak Mar 15 '19 at 18:21
• @kelalaka i want to generate it on linux machine. Probably my statement that there are not many sources of enthropy was wrong... I updated the question – uduck Mar 20 '19 at 11:59
• Linux is not enough, does urandom available? If so see – kelalaka Mar 20 '19 at 12:02
• Just read from /dev/urandom then :) – Frank Denis Mar 21 '19 at 12:43

If you have access to a Linux box you don't need any weird sources of entropy or timestamps. It's already there, securely built in. Simply do:-

dd if=/dev/random of=random_bits bs=1 count=32 iflag=fullblock

after you have been using the machine for a good few minutes. The usage is important as it reads your I/O activities and securely extracts information entropy from it. You'll have 256 bits of excellent entropy in the file called random_bits. This is the closest you'll get to using a TRNG without separate TRNG hardware The PC is the hardware. The key will be as good as you'll ever see. Then simply hard code within your device. You can see them with:-

xxd random_bits

Hard coding is very common in retail/consumer devices and there will be several in your home (smart door bell, smart TV, video recorder, pet id etc.) It's not as secure (or complicated) as key exchange, but it'll probably do.

Note that this answer relates specifically to the one off /few key(s) requirement of this question. More frequent key requests may cause /dev/random to block. However, anecdotally I get ~56kbits of output per hour simply dealing with my emails (on Ubuntu 18).

• Use /dev/urandom. Not /dev/random. 2uo.de/myths-about-urandom – Frank Denis Mar 22 '19 at 18:49
• @PaulUszak The former is faster and is still completely secure. Most *nix operating systems actually use the same character devices for both. Linux is the outlier here, for silly reasons. – forest Mar 24 '19 at 1:46
• @PaulUszak I think you completely misunderstand how the Linux random driver works... – forest Apr 2 '19 at 2:46
• @FrankDenis I find it to be a myth of a myth that's kinda fake news. Thomas Hühn has misunderstood the consequence of the blockage, it's implication for information-theoretic security vis-à-vis gold standard TRNGs and overlooked what Thomas Pornin told him in his quote. Consequently there is a proven mathematical/entropy distinction that could be restated loosely as random output is more random than urandom. It certainly is within P=NP and Kolmogorov contexts. It's like malt v blended whiskey. Both get you drunk but the former does it with charisma. – Paul Uszak Apr 2 '19 at 11:30
• @PaulUszak Still, you are misunderstanding how it works. – forest Apr 3 '19 at 2:50

A "good" secret key should have the same probability as any other possible key to be chosen.

No matter what extractor you will be using, if your entropy source is limited to the current timestamp, this is very unlikely to be the case.

Unless you have access to a hardware random number generator, you should combine as many independent entropy sources as possible.

As to the actual entropy collection, answering your question is impossible without knowing what your environment is.

• I want to generate it on linux machine. Probably my statement that there are not many sources of enthropy was wrong... I updated the question – uduck Mar 20 '19 at 11:59
• Thanks for you answer. I lack the knowledge in this cryto related randomness. I am curious about this situation: If we have true random number generator uniformely ditributed, then any number is as possible as any other (as you mentioned), so the 0 is possible or the number 0x0000ffff0000ffff is also possible. But would those two be a good secret key? – uduck Mar 21 '19 at 13:13
• Yes, they would be "good secret keys". If they weren't, it would mean that an adversary will not even have to try them, effectively reducing the key space and making the attack faster. Now, it depends what these keys are for. If you are multiplying numbers by 0 or the identity, that can have pretty bad implications. Answering your question needs more context, or a description of what you are actually trying to achieve. – Frank Denis Mar 22 '19 at 18:48