<p>It uses a cryptographically-secure random number generator, specifically the one included in OpenSSL. Generating a key from a source with less entropy than the equivalent bit strength of the key would be an inexcusable rookie coder error. It wouldn't survive in any popular open source program for more than a few days.</p>

CC BY-SA 3.0
2012-02-01T00:21:48.953Z
We would all like that to be true, but unfortunately it's not.  Debian's [broken patch](http://www.debian.org/security/2008/dsa-1571) to OpenSSL survived over a year and a half.  It was caused by a change that reduced the entropy used.  It's certainly easier to root out vulnerabilities in open source software.  But that doesn't mean it always happens right away.
Matthew Flaschen
CC BY-SA 3.0
2012-02-01T01:03:03.850Z
That's a much different kind of error than the one contemplated in this question. But you're right that, unfortunately as it happened, the effect was the same.
David Schwartz
CC BY-SA 3.0
2012-01-31T20:43:51.660Z
2012-01-31T20:43:51.660Z
David Schwartz
<p>There has been some discussion on flaws on key generation entropy in standard Bitcoin client.
Check <a href="https://bitcointalk.org/index.php?topic=113496.0" rel="nofollow">https://bitcointalk.org/index.php?topic=113496.0</a>.</p>

<p>Basically, RandAddSeedPerfmon() and RegQueryValueExA(HKEY_PERFORMANCE_DATA,..) calls done in Bitcoin source code can fail without the user getting notice.</p>

<p>The single only reliable source of entropy in the standard Bitcoin client is OpenSSL RAND_Screen(), function which is called on initialization of the rand pool.</p>

CC BY-SA 3.0
2012-11-14T17:23:07.150Z
2012-11-14T17:23:07.150Z
SDL
<p>In addition to microsecond time, Bitcoin seeds the random number generator with GUI events, /dev/urandom on Unix, and HKEY_PERFORMANCE_DATA on Windows (very random, constantly-changing data).</p>

CC BY-SA 3.0
2012-11-14T22:19:44.157Z
No `CryptGenRandom` on Win?
CodesInChaos
CC BY-SA 3.0
2012-11-15T04:52:11.957Z
@CodesInChaos No.
theymos
CC BY-SA 3.0
2012-01-31T23:48:23.590Z
2012-01-31T23:48:23.590Z
theymos
<p>Is the random library used by the standard client in any way deterministic, or can one count on it being truly random?</p>

<p>For example, often random libraries are initialized with seed value of the current time, like in C++:</p>

<pre><code>srand(time(NULL));
</code></pre>

<p>But if someone was to iterate over reasonable ranges of time when a client started, eventually one would use the same seed value, and thus be able to generate the same addresses.</p>

<p>Is the random library used by the standard client vulnerable to such an attack, or does it also use some other variables that are unpredictable (say, temperature of the processor down  to such decimal places it becomes an unpredictable noise)?</p>

<bitcoin-core><security><library>
Address creation in standard client - random library?
ThePiachu
# Address creation in standard client - random library?

(Asked by: username_0 on 2012-01-31)

Is the random library used by the standard client in any way deterministic, or can one count on it being truly random?

For example, often random libraries are initialized with seed value of the current time, like in C++:

```
srand(time(NULL));

```

But if someone was to iterate over reasonable ranges of time when a client started, eventually one would use the same seed value, and thus be able to generate the same addresses.

Is the random library used by the standard client vulnerable to such an attack, or does it also use some other variables that are unpredictable (say, temperature of the processor down to such decimal places it becomes an unpredictable noise)?

**Tags:** bitcoin-core, security, library


---

## 3 answers

### Answer by username_4 on 2012-01-31. Score: 6 | Accepted answer

In addition to microsecond time, Bitcoin seeds the random number generator with GUI events, /dev/urandom on Unix, and HKEY\_PERFORMANCE\_DATA on Windows (very random, constantly-changing data).

> **Comments:**
> **username_5**: No `CryptGenRandom` on Win?  
> **username_4**: @username_5 No.  

---

### Answer by username_1 on 2012-01-31. Score: 5

It uses a cryptographically-secure random number generator, specifically the one included in OpenSSL. Generating a key from a source with less entropy than the equivalent bit strength of the key would be an inexcusable rookie coder error. It wouldn't survive in any popular open source program for more than a few days.

> **Comments:**
> **username_2**: We would all like that to be true, but unfortunately it's not.  Debian's [broken patch](http://www.debian.org/security/2008/dsa-1571) to OpenSSL survived over a year and a half.  It was caused by a change that reduced the entropy used.  It's certainly easier to root out vulnerabilities in open source software.  But that doesn't mean it always happens right away.  
> **username_1**: That's a much different kind of error than the one contemplated in this question. But you're right that, unfortunately as it happened, the effect was the same.  

---

### Answer by username_3 on 2012-11-14. Score: 0

There has been some discussion on flaws on key generation entropy in standard Bitcoin client.
Check <https://bitcointalk.org/index.php?topic=113496.0>.

Basically, RandAddSeedPerfmon() and RegQueryValueExA(HKEY\_PERFORMANCE\_DATA,..) calls done in Bitcoin source code can fail without the user getting notice.

The single only reliable source of entropy in the standard Bitcoin client is OpenSSL RAND\_Screen(), function which is called on initialization of the rand pool.


---

