Libgcrypt provides 3 levels or random quality: The level
GCRY_VERY_STRONG_RANDOM usually used for key generation, the
GCRY_STRONG_RANDOM for all other strong random
requirements and the function
gcry_create_nonce which is used
for weaker usages like nonces. There is also a level
GCRY_WEAK_RANDOM which in general maps to
GCRY_STRONG_RANDOM except when used with the function
gcry_mpi_randomize, where it randomizes an
multi-precision-integer using the
There are two distinct random generators available:
random/random-csprng.cand used by default.
random/random-fips.cand used if Libgcrypt is in FIPS mode.
Both generators make use of so-called entropy gathering modules:
Uses the operating system provided /dev/random and /dev/urandom devices. The /dev/gcrypt/random.conf config option only-urandom can be used to inhibit the use of the blocking /dev/random device.
Runs several operating system commands to collect entropy from sources
like virtual machine and process statistics. It is a kind of
/dev/random implementation. It is not available in
Uses the operating system provided Entropy Gathering Daemon (EGD). The EGD basically uses the same algorithms as rndunix does. However as a system daemon it keeps on running and thus can serve several processes requiring entropy input and does not waste collected entropy if the application does not need all the collected entropy. It is not available in FIPS mode.
Targeted for the Microsoft Windows OS. It uses certain properties of that system and is the only gathering module available for that OS.
Extra module to collect additional entropy by utilizing a hardware random number generator. As of now the supported hardware RNG is the Padlock engine of VIA (Centaur) CPUs and x86 CPUs with the RDRAND instruction. It is not available in FIPS mode.
Extra module to collect additional entropy using a CPU jitter based approach. This is only used on X86 hardware where the RDTSC opcode is available. The /dev/gcrypt/random.conf config option disable-jent can be used to inhibit the use of this module.
|• CSPRNG Description:||Description of the CSPRNG.|
|• FIPS PRNG Description:||Description of the FIPS X9.31 PRNG.|