Re: [PATCH] using arc4random for strong randomness matters.

Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> writes:

> David CARLIER <devnexen(at)gmail(dot)com> writes:
>> I m not against as such that depends of the implementation but I ve seen in
>> quick glance it s RC4 ?

arc4random uses ChaCha20 since OpenBSD 5.5 (and libbsd 0.8.0 on Linux).
It uses getentropy(2) to seed itself at regular intervals and at fork().

http://man.openbsd.org/arc4random.3

> More generally, why should we bother with an additional implementation?
> Is this better than /dev/urandom, and if so why?

If what is wanted is something more like /dev/urandom, one can call
getentropy(2) (or on Linux, getrandom(2)) directly, which avoids having
to open the device file each time.

http://man.openbsd.org/getentropy.2
https://manpages.debian.org/stretch/manpages-dev/getrandom.2.en.html

- ilmari
--
"The surreality of the universe tends towards a maximum" -- Skud's Law
"Never formulate a law or axiom that you're not prepared to live with
the consequences of." -- Skud's Meta-Law