rand vs. random 2594

No, it is not just their fault. It is also the fault of the writer of thedev-urandom man page, which unjustifiably casts doubt ondev-urandom. Also, anyone who comes here to ask aboutdev-random vsdev-urandom already does not know enough to make that decision, and should usedev-urandom. There is something "wrong" withdev-random. It blocks. That IS a problem. IF the user knows that, and knows what that means, and knows that will never cause problems, then fine, they can use it. In that case however, it is almost always true that they should rather get a real physical random number generator and use that instead.dev-random uses sources of randomness which are at least a bit dodgy ( at least as dodgy as is the use of the PRNG indev-urandom). Ie, once you know enough that you know you should usedev-random, despite its problem, instead ofdev-urandom, you probably should not usedev-random either, but instead shell out the money to get a real random number generator.

Who knows. There could be millions of reasons, including that Linux is not a crypto expert. Linux has many tools which are far better covered by other programs in any distribution. It costs nothing to keep them, and might break something if they are removed. And maybe there is some rare case wheredev-random might be better thandev-urandom.

The Intel chips have long had an onboard physical random number generator.dev-random anddev-urandom do not use it if it exists. Why? Probably becuase the danger of introducing bugs by revisiting an old routine are far greater than the benefits.