EVP_RAND-JITTER(7ossl)

🎀 NAME 🎀

okay bestie, meet EVP_RAND-JITTER — the randomness seed source EVP_RAND implementation, and yes, this is the EVP_RAND-JITTER(7ossl) manual page 💖

🦋 DESCRIPTION 🦋

Support for deterministic random number generator seeding through the EVP_RAND API. slay.

This software seed source produces randomness based on tiny CPU "jitter" fluctuations. literally microscopic CPU wobble vibes ✨

It is available when OpenSSL is compiled with the enable-jitter option. When available, it is listed in openssl list -random-generators and openssl info -seeds. iconic behavior, no cap.

🪪 Identity 🪪

"JITTER" is the name for this implementation; it can be used with the EVP_RAND_fetch() function.

🎛️ Supported parameters 🎛️

The supported parameters are:

• "state" (OSSL_RAND_PARAM_STATE) — <integer>
• "strength" (OSSL_RAND_PARAM_STRENGTH) — <unsigned integer>
• "max_request" (OSSL_RAND_PARAM_MAX_REQUEST) — <unsigned integer>
• "fips-indicator" (OSSL_RAND_PARAM_FIPS_APPROVED_INDICATOR) — <integer>. This parameter is available in the FIPS provider and returns 1.

These parameters work as described in "PARAMETERS" in EVP_RAND(3). periodt.

💅 NOTES 💅

A context for the seed source can be obtained by calling:

EVP_RAND *rand = EVP_RAND_fetch(NULL, "JITTER", NULL);
EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, NULL);

The enable-jitter option was added in OpenSSL 3.4.

By specifying the enable-fips-jitter configuration option, the FIPS provider will use an internal jitter source for its entropy. Enabling this option will cause the FIPS provider to operate in a non-compliant mode unless an entropy assessment ESV (https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations) and validation through the CMVP (https://csrc.nist.gov/projects/cryptographic-module-validation-program) are additionally conducted. This option was added in OpenSSL 3.5.

🚨 bestie, read that again: non-compliant mode unless the ESV entropy assessment and CMVP validation are additionally conducted. That's the whole warning, don't skip it.

🔥 EXAMPLES 🔥

okay here's the code, bestie — copy it exactly, it's giving seed-source-to-DRBG pipeline:

EVP_RAND *rand;
EVP_RAND_CTX *seed, *rctx;
unsigned char bytes[100];
OSSL_PARAM params[2], *p = params;
unsigned int strength = 128;

/* Create and instantiate a seed source */
rand = EVP_RAND_fetch(NULL, "JITTER", NULL);
seed = EVP_RAND_CTX_new(rand, NULL);
EVP_RAND_instantiate(seed, strength, 0, NULL, 0, NULL);
EVP_RAND_free(rand);

/* Feed this into a DRBG */
rand = EVP_RAND_fetch(NULL, "CTR-DRBG", NULL);
rctx = EVP_RAND_CTX_new(rand, seed);
EVP_RAND_free(rand);

/* Configure the DRBG */
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_CIPHER,
                                        SN_aes_256_ctr, 0);
*p = OSSL_PARAM_construct_end();
EVP_RAND_instantiate(rctx, strength, 0, NULL, 0, params);

EVP_RAND_generate(rctx, bytes, sizeof(bytes), strength, 0, NULL, 0);

EVP_RAND_CTX_free(rctx);
EVP_RAND_CTX_free(seed);

🌈 SEE ALSO 🌈

• EVP_RAND(3)
• "PARAMETERS" in EVP_RAND(3)

👑 COPYRIGHT 👑

Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

and that's the whole page, bestie 💖 — OpenSSL 3.5.9, dated 2026-09-29, manual page EVP_RAND-JITTER(7ossl). periodt ✨