-1

I'm looking at way to generate random numbers for cryptographic purposes. More specifically, I looked at the Linux /dev/urandom function, which is considered a real random number generator. There are others number generators such as the glibc rand() function, but this one is not considered sure for cryptographic purposes, whereas linux /dev/urandom is.

The difference between them is that /dev/urandom gets his seed from "environmental noise" and I struggle to exactly understand what is this and how it allows good randomness.

Patrick Mevzek
  • 1,748
  • 2
  • 10
  • 23
Sam The Sid
  • 1
  • 2
  • The [wiki page](https://en.wikipedia.org/wiki//dev/random) for this topic includes the [citation](https://en.wikipedia.org/wiki//dev/random#cite_note-1) to the [definitive source](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/char/random.c?id=refs/tags/v3.15.6#n52) for what "environmental noise" means. – schroeder Sep 24 '20 at 08:52

1 Answers1

0

The first important thing to understand is that you can't program a computer to do something randomly - however complex the algorithm you write, it will always go from some initial state to some final state, and if you can perfectly recreate the initial state, you can perfectly recreate the final state.

The second important thing to understand is that you can feed randomness into a computer - if your initial state is completely unpredictable, then you can make your final state completely unpredictable.

"Environmental noise" is referring to this external source of random input (or "entropy"). It can take a variety of forms, such as:

  • Reading the signal on an audio input line, or a radio antenna, and keeping the least significant bits of the signal (the tiny fluctuations you'd normally discard as noise)
  • Timing the user's interactions with keyboard and mouse, again discarding most of the signal and keeping the noise
  • Filming a wall of lava lamps

The idea is to stop an attacker doing two things:

  • predicting your random numbers, by knowing your input state and algorithm
  • influencing your random numbers, by changing your input state to one they know

Consider audio noise as an example:

  • if they could measure the same input as you, they could predict your seed, but even placing a microphone next to yours won't record identical noise measured at a high resolution
  • if they make a noise near your microphone, it will influence your seed, but again not with enough precision to be useful to them
IMSoP
  • 3,780
  • 1
  • 15
  • 19