Default mcrypt_create_iv() to /dev/urandom

Hi internals! Currently the mcrypt_create_iv() function uses /dev/random as the default source for random bytes. This is problematic, because /dev/random will block if entropy for reseeding the kernel's CSPRNG is estimated to be low. If mcrypt_create_iv() with default parameters is used in any kind of user-facing code the blocking will cause unpredictable slowdowns and can be easily exploited for a denial of service attack. /dev/urandom - contrary to popular misconception - is also a cryptographically safe source of randomness and is recommended over the use of /dev/random for most (sometimes all) applications [1] [2] [3] [4] [5]. Quoting from the /dev/random man page [1]: > If you are unsure about whether you should use */dev/random* or > */dev/urandom*, then probably you want to use the latter. As a > general rule, */dev/urandom* should be used for everything except > long-lived GPG/SSL/SSH keys. [*] One potential issue when using /dev/urandom is that on some systems (notably Linux, but not BSD) it will not block even if it can't gather enough initial entropy for seeding the CSPRNG and as such produce predicable outputs. This condition can only occur immediately after system startup and as per the /dev/random man page [1] this is mitigated by "all major Linux distributions [...] since 2000 at least" by saving a seed file. As such I would suggest defaulting the mcrypt_create_iv() $source parameter to MCRYPT_DEV_URANDOM. Objections? Nikita [*] The latter claim is disputed, see for example the end of [4]. [1]: http://man7.org/linux/man-pages/man4/random.4.html [2]: http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ [3]: http://security.stackexchange.com/questions/3936/is-a-rand-from-dev-urandom-secure-for-a-login-key/3939#3939 [4]: http://blog.cr.yp.to/20140205-entropy.html [5]: http://www.2uo.de/myths-about-urandom/