Random mouse input vs random keyboard input vs CryptoAPI

Question

I ask this question because it's really starting to annoy me to move my mouse until the " generated bits : 256 " appear every time I want to generate an password on Keepassand I wonder, why software require me to this tedious and completely non random task ( Humans are not random, even myself can see that I have a pattern when moving my mouse in this small square box, usually down,up,left,right,repeat).

So my question is : If I'm really forced to use mouse input or keyboard input which are more random ? Assume that people will be lazy, and there will be a pattern on mouse input and keyboard input ( people are lazy, they won't input symbols or special characters just A-Z mostly )

And why can't Keepass just rely on Windows CryptoAPI ? What is wrong with it ?

Answer 1

Boiling down RNG (random number generators) discussions: It all depends on how your system and/or software you're using wants to use the random number entropy pool.

Most systems rely on the OS kernel to maintain a pool with sufficient entropy to provide all RNG operations. If hardware is available, this will use disk rpm, interrupt operations, even thermal changes in CPU (Haswell). In the case of your software package that wants mouse movements for key generation, it's most likely seeding it's own entropy pool because it doesn't necessarily trust the OS.

There's a lot of discussion around limitations of RNG in virtualized environments (though most have been quelled with good research), but in the case of software manually asking for "movements", the movement provided by a human using a keyboard or mouse will generate enough random data (not just the movement but the I/O variables) to compensate for insufficiencies in the OS entropy pool. What the software is showing is not the actual entropy and unless it was written by a 4 year old, mouse movement will generate plenty of I/O entropy to satisfy most pseudorandom number generators falling just short of NIST/FIPS compliance.

This is where TrueCrypt failed because while they allowed hardware to manage entropy management, they capped their prime number ranges, allowing easy guessing of numbers used for keygen (from what I read).

Makes sense?

Answer 2

You may have patterns that look predictable, but are you moving exactly the same amount every time - in microseconds? The simple answer is that you are essentially random, at the resolution required by the generator which will use you as the seed.

Computers should be able to use the crypto function to generate random numbers, but what if it has been compromised on that machine...

would you know?

Using your own movements protects you from that scenario.