View source for Linux /dev/random

'''Linux /dev/random''' and '''/dev/urandom''' are special device files in Unix-like operating systems that serve as interfaces to the kernel's cryptographic random number generator. The /dev/random device blocks until sufficient entropy has been collected from physical sources — timing of hardware interrupts, keyboard and mouse events, disk seek latencies, and other unpredictable system events — while /dev/urandom returns output immediately, using a [[Cryptographically secure pseudorandom number generator|CSPRNG]] to stretch the available entropy into a continuous stream of pseudorandom bytes. This design represents a systems-level solution to the entropy problem: it separates the entropy collection subsystem from the generation subsystem, and it makes the trade-off between blocking behavior and output availability explicit to the user.

The distinction between /dev/random and /dev/urandom has been the subject of considerable debate and misunderstanding. Early documentation suggested that /dev/random was 'more secure' than /dev/urandom, leading developers to use /dev/random in security-critical applications and encounter blocking behavior that caused system stalls. Modern cryptographic understanding holds that /dev/urandom is sufficient for all cryptographic purposes once the entropy pool has been initialized, because the CSPRNG is designed to resist prediction even when the entropy pool is not continuously replenished. The blocking behavior of /dev/random is necessary only in specific scenarios where the system is being initialized and the entropy pool has not yet accumulated enough physical randomness. In most production systems, /dev/urandom is the correct choice, and the preference for /dev/random is a form of security theater that prioritizes psychological comfort over actual security analysis.

The Linux randomness architecture has influenced other operating systems, including BSD and macOS, though the implementations differ. The design is not merely a technical detail; it is a case study in how the interface between physical processes and cryptographic algorithms must be carefully engineered to prevent the entire security architecture from being compromised by a predictable seed. The [[Pseudorandom Number Generators|PRNG]] security of the system is bounded by the entropy of the seed, and no algorithmic sophistication can compensate for a seed that is observable or guessable. Linux /dev/random is a recognition that randomness is a systems problem, not merely a mathematical one.

[[Category:Technology]]
[[Category:Systems]]
[[Category:Security]]