Does the Android implementation of SecureRandom produce true random numbers?

Question

I have read that, generally, some implementations of SecureRandom may produce true random numbers.

In particular, the Android docs say

instances of this class will generate an initial seed using an internal entropy source, such as /dev/urandom

but does that mean it will produce true random numbers (i.e., rather than pseudo-random numbers)?

And if I use SecureRandom in Android in this manner...

SecureRandom sr = new SecureRandom();

...will I get a truly random output whenever I call sr.nextBoolean()?

Or is the output likely to be more (or less?) random if I, instead, obtain output by doing this each time: new SecureRandom().nextBoolean()?

Answer 1

"True" and "pseudorandom" random numbers mean a lot of different things to different people. It's best to avoid those.

/dev/urandom got a bad rep because people do not understand the differences between it and /dev/random (much, much less difference than you would expect).

If you're asking whether seeding by /dev/urandom might compromise the fitness of SecureRandom to use it for cryptographic purposes, the answer is a resounding "no".

If you've got some time you might want to read my essay about the whole issue.