tl;dr
What is a CSPRNG?
A CSPRNG is a Cryptographically Secure Pseudo Random Number Generator. It is the cousin of the RNG, or Random Number Generator that we used decades ago.
In the past, rand and seed were used together to generate pseudo random numbers. When a constant seed is provided (e.g., the number 125), the random numbers generated by rand are well-defined.
These two functions actually complement each other well in fuzz-testing applications, since the sequence of randomness can be reproduced between invocations of the tool.
However, there's a problem: these functions are not viable for creating key material. In cryptography, well-formed randomness is required. As such, rand and seed are not candidates for generating key material. What is needed is a source of randomness that mimics the real world: such as the path a leaf takes when falling to the ground.
In the cryptography discipline, CSPRNGs are used to generate private and public key material, such as those used for certificates, secure shell sessions, and cryptocurrency.
Can I generate my own CSPRNG on Linux, using a shell?
Yes. It turns that on Linux, it's a very easy task.
Every (or almost every) recent Linux implementation generates random data that can be accessed through /dev/random, /dev/arandom, and /dev/urandom. There are differences between these implementations that you should be aware of when selecting them for any variety of solutions. See here for more information:
/dev/random vs /dev/urandom and are they secure?
For this example, we will use /dev/urandom.
The easiest method of obtaining random data is via
cat. We'll follow that by extracting a set number of bits, reformatting the data, and delivering a string of hexadecimal digits.
The One-Liner:
cat /dev/urandom | head -c 2048| od -x | cut -b 8-40 | xargs | sed 's/ //g' | head -c 32
If you want a bit more sophistication, then here's a full script:
#!/bin/bash
# =================================================================
# File : csprng.sh
# Function: Generate a cryptographically secure random number
# Who : David Means <www.w1t3h4t.com>
# =================================================================
function doHelp()
{
echo
echo "Generate a cryptographically secure random number"
echo
echo "Usage: $(basename $0) {bits}"
echo
echo "Example: $(basename $0) 128"
}
if [ $# -eq 0 ] ; then
doHelp
exit
fi
bytes=0
bitCheck=$(($1 % 8))
if [ $bitCheck -eq 0 ]; then
bytes=$(($1 / 8))
cat /dev/urandom | head -c 2048 | od -x | cut -b 8-40 | xargs | sed 's/ //g' | head -c ${bytes}
echo
else
echo
echo "$1 not divisable by 8"
echo
fi
