espressif/mbedtls
1
0
Fork 0
mirror of https://github.com/espressif/mbedtls.git synced 2026-08-08 12:37:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Document /dev/random vs /dev/urandom on Linux

Browse Source 
Signed-off-by: Gilles Peskine <[email protected]>
This commit is contained in:
Gilles Peskine
2026-02-25 22:43:19 +01:00
parent 8f962c1b22
commit 409baa7b7b
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/mbedtls/mbedtls_config.h
+19
View File
@@ -4161,6 +4161,25 @@
* non-Windows platforms unless a dedicated system call is available
* (see #MBEDTLS_NO_PLATFORM_ENTROPY).
*
* The default value is `/dev/urandom`, which is suitable on most platforms
* other than Linux. On Linux, either `/dev/random` or `/dev/urandom`
* may be the right choice, depending on the circumstances:
*
* - If possible, the library will use the getrandom() system call,
* which is preferable, and #MBEDTLS_PLATFORM_DEV_RANDOM is not used.
* - If there is a dedicated hardware entropy source (e.g. RDRAND on x86
* processors), then both `/dev/random` and `/dev/urandom` are fine.
* - `/dev/random` is always secure. However, with kernels older than 5.6,
* `/dev/random` often blocks unnecessarily if there is no dedicated
* hardware entropy source.
* - `/dev/urandom` never blocks. However, it may return predictable data
* if it is used early after the kernel boots, especially on embedded
* devices without an interactive user.
*
* Thus you should change the value to `/dev/random` if your application
* may be used on a device running Linux without a dedicated hardware
* entropy source early after boot.
*
* This is the default value of ::mbedtls_platform_dev_random, which
* can be changed at run time.
*/