What Android API's can be used a practical sources of entropy ?
Given the requirement of sourcing entropy on the phone for purposes of seeding a PRNG, what are good options ?
I have a hard external requirement to periodically supplement the entropy of the RNG, which in the case of SecureRandom, I will do by calling setSeed and passing in the new entropy.
The Android docs for setSeed state:
The given seed supplements, rather than replaces, the existing seed. Thus, repeated calls are guaranteed never to reduce randomness..
As a result, I'm pretty confident that this is the safe and correct way to supplement the entropy of the RNG, but I need guidance as to appropriate on-device sources of entropy.
I have a FIPS compliant HSM on the server side that will contribute, but I need a safe source of additional entropy on the mobile device side.
Recommended options include the lower-order bits of random chunks of memory and phone sensors, and I would appreciate comment in this regard.