How can I increase /proc/sys/kernel/random/entropy_avail

Question

I have access to genuine random numbers - random.org, for example.

I have a number of processes using /dev/random and my value for /proc/sys/kernel/random/entropy_avail is 143, which is pretty low.

I'd like to have a process that monitors /proc/sys/kernel/random/entropy_avail and, when it drops below about 3000, tops it up.

How can I incorporate the random numbers from random.org into /dev/random so that entropy_avail increases?

score 4 · Answer 1 · edited Jan 21 '22 at 10:01

Do not use an online source of entropy!

If your system currently has insufficient entropy, then it will not be able to make a secure connection to random.org and any material you download from it will not be secret. Furthermore, you should not be using the blocking device anyway. It's perfectly fine to use /dev/urandom, no matter how low the entropy estimate is. If for whatever reason you are using a program that is foolishly using the blocking device, you can keep it topped off by installing haveged, a daemon that attempts to generate random data from memory latency. Please see https://www.2uo.de/myths-about-urandom for more.

If you still want to shoot yourself in the foot, then you can use an IOCTL on the random character device to adjust the entropy estimate. From random(4), the RNDADDENTROPY IOCTL is what you want:

RNDADDENTROPY
       Add some additional entropy to the input pool, incrementing
       the entropy count.  This differs from writing to /dev/random
       or /dev/urandom, which only adds some data but does not incre‐
       ment the entropy count.  The following structure is used:

           struct rand_pool_info {
               int    entropy_count;
               int    buf_size;
               __u32  buf[0];
           };

       Here entropy_count is the value added to (or subtracted from)
       the entropy count, and buf is the buffer of size buf_size
       which gets added to the entropy pool.

This IOCTL requires the CAP_SYS_ADMIN capability to function.

Very related:

Adding online entropy source probably doesn't really warrant such a strongly worded warning. AFAIU it doesn't really hurt to add entropy from an online source of entropy, at worst it'll just give you fuzzy feeling because your entropy_avail value appears higher, but it shouldn't cause the output of your /dev/(u)random to be any less unpredictable. So while it may be useless if the attacker controls one of your entropy source, it wouldn't really be harmful? — Lie Ryan, Feb 27 '19 at 11:06
@LieRyan You're correct, but only because of how a quirk of the Linux kernel random driver works. Generally, getting random data from an online source is a terrible idea. It's for the same reason that I would warn strongly against homebrew crypto even if OP is planning on cascading it with AES. — forest, Feb 27 '19 at 11:07

How can I increase /proc/sys/kernel/random/entropy_avail

1 Answers1