Should we use getentropy() for os.urandom()?

Hi, I followed discussions on the new systems getrandom() on Linux and getentropy() on OpenBSD. I wanted to use them in Python to avoid the need of a file descriptor to read /dev/urandom. Linux getrandom() is also more secure than /dev/urandom because it blocks until /dev/urandom is feeded with enough entropy. getentropy() and getrandom() are now used in Python 2.7.10, Python 3.4 and newer. Today, an issue was reported on Solaris because os.urandom() is much slower with Python 2.7.10: https://bugs.python.org/issue25003 It looks like Solaris has getrandom() and getentropy(), and getentropy() is slow. Now I'm not sure that I understood the purpose of getentropy() even on OpenBSD. Should it be used to feed a PRNG in user-space, or can it be used as a PRNG? http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2?query=getentropy&sec=2 If getentropy() must only be used to feed a PRNG (which only use a few bytes), we should remove the code using getentropy() (but getrandom() should be kept). Note: I didn't know that other operating systems supported getrandom() and getentropy()! The feature looks recent in Solaris: " Solaris 11.3 adds two new system calls, getrandom(2) and getentropy(2), for getting random bit streams or raw entropy." https://blogs.oracle.com/darren/entry/solaris_new_system_calls_getentropy (article published at July, 2015) Note2: There is an open discussion proposing to "Use arc4random under OpenBSD for os.urandom() if /dev/urandom is not present" https://bugs.python.org/issue22542 getentropy() issue in Python (closed): https://bugs.python.org/issue22585 getrandom() issue in Python (closed): https://bugs.python.org/issue22181 Victor

I'm no expert, but from the bug report and the man page you quoted it does sound like getentropy() should only be used to seed a PRNG. It also sounds like reading /dev/[u]random should be considered a PRNG. For evidence, the man page on OS X says: "The random device produces uniformly distributed random byte values of potentially high quality." It goes on to describe the difference between the two on Linux (where urandom produces lower quality when it runs out of entropy while random apparently blocks). It does sound like we should not call getentropy() except to get a good seed for our own PRNG. On Fri, Sep 4, 2015 at 3:45 PM, haypo s <victor.stinner@gmail.com> wrote:
-- --Guido van Rossum (python.org/~guido)

On September 4, 2015 at 7:08:36 PM, Guido van Rossum (guido@python.org) wrote:
I don't recall the difference between getentropy and getrandom but /dev/(u)random are basically the exact same except /dev/random tries to gues how "random" it’s numbers are. The manpage for /dev/(u)random is basically wrong. (See http://www.2uo.de/myths-about-urandom/ and http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/). Someone who remembers what getentropy implements would have to chime in on whether we should use it or not, but getrandom is basically a better form of /dev/urandom. ----------------- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

I'm no expert, but from the bug report and the man page you quoted it does sound like getentropy() should only be used to seed a PRNG. It also sounds like reading /dev/[u]random should be considered a PRNG. For evidence, the man page on OS X says: "The random device produces uniformly distributed random byte values of potentially high quality." It goes on to describe the difference between the two on Linux (where urandom produces lower quality when it runs out of entropy while random apparently blocks). It does sound like we should not call getentropy() except to get a good seed for our own PRNG. On Fri, Sep 4, 2015 at 3:45 PM, haypo s <victor.stinner@gmail.com> wrote:
-- --Guido van Rossum (python.org/~guido)

On September 4, 2015 at 7:08:36 PM, Guido van Rossum (guido@python.org) wrote:
I don't recall the difference between getentropy and getrandom but /dev/(u)random are basically the exact same except /dev/random tries to gues how "random" it’s numbers are. The manpage for /dev/(u)random is basically wrong. (See http://www.2uo.de/myths-about-urandom/ and http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/). Someone who remembers what getentropy implements would have to chime in on whether we should use it or not, but getrandom is basically a better form of /dev/urandom. ----------------- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA
participants (3)
-
Donald Stufft
-
Guido van Rossum
-
haypo s