Manual Pages  — RANDOM

In addition to read(2), the direct output of the abstract kernel entropy device can be read with getrandom(2), getentropy(3), or the sysctl(8) pseudo-variable kern.arandom.

To see the current settings of the software random device, use the command line:

    sysctl kern.random

which results in something like:

kern.random.block_seeded_status: 0
kern.random.fortuna.minpoolsize: 64
kern.random.harvest.mask_symbolic: ENABLEDSOURCE,[DISABLEDSOURCE],...,CACHED
kern.random.harvest.mask_bin: 00000010000000111011111
kern.random.harvest.mask: 66015
kern.random.use_chacha20_cipher: 0
kern.random.random_sources: 'Intel Secure Key RNG'

Other than kern.random.block_seeded_status, kern.random.fortuna.minpoolsize, and kern.random.harvest.mask, all settings are read-only.

The kern.random.fortuna.minpoolsize sysctl is used to set the seed threshold. A smaller number gives a faster seed, but a less secure one. In practice, values between 64 and 256 are acceptable.

The kern.random.harvest.mask bitmask is used to select the possible entropy sources. A 0 (zero) value means the corresponding source is not considered as an entropy source. Set the bit to 1 (one) if you wish to use that source. The kern.random.harvest.mask_bin and kern.random.harvest.mask_symbolic sysctls can be used to confirm settings in a human readable form. Disabled items in the latter item are listed in square brackets. See random_harvest(9) for more on the harvesting of entropy.

Ferguson, Schneier, Kohno, Cryptography Engineering, ISBN 978-0-470-47424-2, Wiley,