<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">I know that iOS (which was listed) has a good randomness source (<a href="https://developer.apple.com/documentation/security/1399291-secrandomcopybytes" class="">SecRandomCopyBytes</a>) but I don’t think OpenSSL uses it yet.</div><div class="">I’m not sure about the quality of Android’s sources, but would expect them to be decent.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Pauli</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 4 Jan 2019, at 10:46 pm, Dr. Matthias St. Pierre <<a href="mailto:Matthias.St.Pierre@ncp-e.com" class="">Matthias.St.Pierre@ncp-e.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><blockquote type="cite" class="">So my concerns are:<br class="">1. Whether I really can count on getting a high-entropy PRNG across these various platforms, without any explicit initialization.<br class=""></blockquote><br class="">Yes, for the mentioned platforms, the default configuration is `--with-rand-seed=os`, which means the DRBG automatically seeds<br class="">and reseeds using os entropy sources.<br class=""><br class="">2. If something goes wrong with PRNG initialization, that it will fail hard rather than fall back to something less secure. And if so how I detect such a failure.<br class=""><br class="">If the (re-)seeding fails, the DRBG enters an error state. When you try to generate random bytes it will detect the error state and try<br class="">automatically to heal the error state by reinstantiating. But if reseeding fails, it will return and error code and not generate any pseudo random bytes.<br class=""><br class="">Citing from the manual pages:<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>OpenSSL comes with a default implementation of the RAND API which is based on the<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>deterministic random bit generator (DRBG) model as described in [NIST SP 800-90A Rev. 1].<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>The default random generator will initialize automatically on first use and will be fully functional<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>without having to be initialized ('seeded') explicitly. It seeds and reseeds itself automatically using<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>trusted random sources provided by the operating system.<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>As a normal application developer, you do not have to worry about any details, just use RAND_bytes(3)<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>to obtain random data. Having said that, there is one important rule to obey: Always check the error<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>return value of RAND_bytes(3) and do not take randomness for granted.<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://www.openssl.org/docs/man1.1.1/man7/RAND.html" class="">https://www.openssl.org/docs/man1.1.1/man7/RAND.html</a><br class=""><br class="">(See also https://www.openssl.org/docs/man1.1.1/man7/RAND_DRBG.html)<br class=""><br class="">Matthias<br class=""><br class="">-- <br class="">openssl-users mailing list<br class="">To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users<br class=""></div></div></blockquote></div><br class=""></div></body></html>