---

17.6.1 Description of the CSPRNG

This random number generator is loosely modelled after the one described in Peter Gutmann’s paper "Software Generation of Practically Strong Random Numbers".⁶

A pool of 600 bytes is used and mixed using the core SHA-1 hash transform function. Several extra features are used to make it robust against a wide variety of attacks and to protect against failures of subsystems. The state of the generator may be saved to a file and initially seeded form a file.

Depending on how Libgcrypt was build, the generator is able to select the best working entropy gathering module. It makes use of the slow and fast collection methods and requires the pool to be initially seeded form the slow gatherer or a seed file. An entropy estimation is used to mix in enough data from the gather modules before returning the actual random output. Process fork detection and protection is implemented.

The implementation of the nonce generator (for gcry_create_nonce) is a straightforward repeated hash design: A 28 byte buffer is initially seeded with the PID and the time in seconds in the first 20 bytes and with 8 bytes of random taken from the GCRY_STRONG_RANDOM generator. Random numbers are then created by hashing all the 28 bytes with SHA-1 and saving that again in the first 20 bytes. The hash is also returned as result.