<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix"><br>
On 06/09/2016 10:22 AM, Donald Stufft wrote:
</div>
<blockquote
cite="mid:A7C3ACE6-2C34-432F-B4B2-E56AB006773C@stufft.io"
type="cite">
<blockquote type="cite">
<pre wrap="">On Jun 9, 2016, at 1:14 PM, Steven D'Aprano <a class="moz-txt-link-rfc2396E" href="mailto:steve@pearwood.info"><steve@pearwood.info></a> wrote:
Just to be clear, this is only an option on Linux, right? All the other
major platforms block, whatever we decide to do on Linux. Including
Windows?
</pre>
</blockquote>
<pre wrap="">
To my knowledge, all other major platforms block or otherwise ensure that /dev/urandom can never return anything but cryptographically secure random. [1]
</pre>
</blockquote>
<br>
I've done some research into this over the past couple of days. To
the best of my knowledge:<br>
<br>
* Linux: /dev/urandom will never block. If the entropy pool isn't
initialized yet, it will return poor-quality random bits from what
is effectively an unseeded PRNG. (Yes: it uses a custom algorithm
which isn't considered CPRNG-strength, it is merely a PRNG seeded
with entropy.)<br>
<br>
* OS X: AFAICT, /dev/urandom guarantees it will never block. It
uses an old CSPRNG, 160-bit Yarrow. The documentation states that
if the entropy pool is "drained", it won't block; instead it'll
degrade ("output quality will suffer over time without any explicit
indication from the random device itself"). It isn't clear how
initialization of the entropy pool during early startup might affect
this. <a class="moz-txt-link-freetext" href="http://www.manpages.info/macosx/random.4.html">http://www.manpages.info/macosx/random.4.html</a><br>
<br>
* FreeBSD: /dev/urandom may block. It also using Yarrow (but maybe
with more bits? and possibly switching soon to Yarrow's successor,
Fortuna?). Both devices guarantee high-quality random bits, and
will block if they feel like they're running low on entropy.<br>
<br>
* OpenBSD 5.1 is like FreeBSD, except the algorithm used is ARC4.
In OpenBSD 5.5 they changed to using ChaCha20.<br>
<br>
On all of those platforms *except* Linux, /dev/random and
/dev/urandom are exactly the same.<br>
<br>
<br>
Also, regarding Windows: Victor Stinner did some experiments with a
VM, and even in early startup he was able to get random bits from
os.urandom(). But it's hard to have a "fresh" Windows VM, so it's
possible it had residual entropy from a previous boot, so this isn't
conclusive.<br>
<br>
<br>
<i>/arry</i><br>
</body>
</html>