EVP_RAND-JITTER(7SSL)

📦
version 4.0.3 · 6 versions
, in ubuntu stonking

✨ EVP_RAND-JITTER ✨

okay bestie, welcome to EVP_RAND-JITTER, the randomness seed source from OpenSSL 💖 she's a whole vibe, and yes, she lives in the 7SSL manual section, so you know she's official.

🌸 NAME 🌸

EVP_RAND-JITTER — the randomness seed source EVP_RAND implementation 🎀

💅 DESCRIPTION 💅

She's here to give you support for deterministic random number generator seeding through the EVP_RAND API. Slay.

This software seed source produces randomness based on tiny CPU "jitter" fluctuations ✨ like, the chaos of your CPU's little timing wobbles? That's the vibe. That's the entropy.

She's available when OpenSSL is compiled with enable-jitter option. And when she IS available, she shows up in openssl list -random-generators and openssl info -seeds — she's not hiding, she's booked and busy 👑

🦋 Identity 🦋

"JITTER" is the name for this implementation, bestie. Use it with the EVP_RAND_fetch() function. That's her government name 💅

🍓 Supported parameters 🍓

Here's what she supports, no gatekeeping:

  • "state" (OSSL_RAND_PARAM_STATE) <integer>
  • "strength" (OSSL_RAND_PARAM_STRENGTH) <unsigned integer>
  • "max_request" (OSSL_RAND_PARAM_MAX_REQUEST) <unsigned integer>
  • "fips-indicator" (OSSL_RAND_PARAM_FIPS_APPROVED_INDICATOR) <integer> — this parameter is available in the FIPS provider and returns 1.

These parameters work as described in "PARAMETERS" in EVP_RAND(3). Periodt 📚

💜 NOTES 💜

Wanna get yourself a context for the seed source? Just call:

EVP_RAND *rand = EVP_RAND_fetch(NULL, "JITTER", NULL);
EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, NULL);

The enable-jitter option was added in OpenSSL 3.4, so if you're on something older, she's not in the group chat yet 🙈

And now the part where we get serious for a sec, bestie, because this is important:

By specifying the enable-fips-jitter configuration option, the FIPS provider will use an internal jitter source for its entropy. Enabling this option will cause the FIPS provider to operate in a non-compliant mode unless an entropy assessment ESV and validation through the CMVP are additionally conducted.

like… that's a real caveat, okay? Don't skip it. That option was added in OpenSSL 3.5 🫶

🔥 EXAMPLES 🔥

Here's the whole thing in action, character for character:

EVP_RAND *rand;
EVP_RAND_CTX *seed, *rctx;
unsigned char bytes[100];
OSSL_PARAM params[2], *p = params;
unsigned int strength = 128;

/* Create and instantiate a seed source */
rand = EVP_RAND_fetch(NULL, "JITTER", NULL);
seed = EVP_RAND_CTX_new(rand, NULL);
EVP_RAND_instantiate(seed, strength, 0, NULL, 0, NULL);
EVP_RAND_free(rand);

/* Feed this into a DRBG */
rand = EVP_RAND_fetch(NULL, "CTR-DRBG", NULL);
rctx = EVP_RAND_CTX_new(rand, seed);
EVP_RAND_free(rand);

/* Configure the DRBG */
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_CIPHER,
                                        SN_aes_256_ctr, 0);
*p = OSSL_PARAM_construct_end();
EVP_RAND_instantiate(rctx, strength, 0, NULL, 0, params);

EVP_RAND_generate(rctx, bytes, sizeof(bytes), strength, 0, NULL, 0);

EVP_RAND_CTX_free(rctx);
EVP_RAND_CTX_free(seed);

ate. no crumbs. 🔥

🌈 SEE ALSO 🌈

Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 💖 this was OpenSSL 4.0.3, dated 2026-09-29, and it's the EVP_RAND-JITTER(7SSL) manual — go forth and seed responsibly 🧚✨

📦 where this page comes from