On Sat, Nov 12, 2016 at 01:25:11PM +0100, Michael Kerrisk (man-pages) wrote: > ┌──────────────┬──────────────┬──────────────────┬────────────────────┐ > │Interface │ Pool │ Blocking │ Behavior in early │ > │ │ │ behavior │ boot time │ > ├──────────────┼──────────────┼──────────────────┼────────────────────┤ > │/dev/random │ Blocking │ If entropy too │ Blocks until │ > │ │ pool │ low, block until │ enough entropy │ > │ │ │ there is enough │ gathered │ > │ │ │ entropy again │ │ > ├──────────────┼──────────────┼──────────────────┼────────────────────┤ > │/dev/urandom │ CSPRNG out‐ │ Never blocks │ Returns output │ > │ │ put │ │ from uninitialized │ > │ │ │ │ CSPRNG (may be low │ > │ │ │ │ entropy and │ > │ │ │ │ unsuitable for │ > │ │ │ │ cryptography) │ > ├──────────────┼──────────────┼──────────────────┼────────────────────┤ > │getrandom() │ Same as │ Does not block │ Blocks until pool │ > │ │ /dev/urandom │ once pool ready │ ready │ > ├──────────────┼──────────────┼──────────────────┼────────────────────┤ > │getrandom() │ Same as │ If entropy too │ Blocks until pool │ > │GRND_RANDOM │ /dev/random │ low, block until │ ready │ > │ │ │ there is enough │ │ > │ │ │ entropy again │ │ > ├──────────────┼──────────────┼──────────────────┼────────────────────┤ > │getrandom() │ Same as │ Does not block │ EAGAIN if pool not │ > │GRND_NONBLOCK │ /dev/urandom │ │ ready │ > ├──────────────┼──────────────┼──────────────────┼────────────────────┤ > │getrandom() │ Same as │ EAGAIN if not │ EAGAIN if pool not │ > │GRND_RANDOM + │ /dev/random │ enough entropy │ ready │ > │GRND_NONBLOCK │ │ available │ │ > └──────────────┴──────────────┴──────────────────┴────────────────────┘ I would change the rightmost column to be "Behavior when pool not yet ready", and just the text in that column accordingly. And the cell, getrandom() GRND_NONBLOCK and blocking behavior, "does not block" is not quite right. It's EAGAIN if pool not ready. This distinguishes this from /dev/urandom & blocking behavior's "Never blocks", in that it will return potentially not fully secure randomness if the pool is not initialized. Cheers, - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
