ChangeLog.d/dev-random.txt

Features
   * The device for reading entropy on platforms without a dedicated system
     call can now be configured with MBEDTLS_PLATFORM_DEV_RANDOM or
     mbedtls_platform_dev_random.

Security
   * The default device for reading entropy on platforms without a dedicated
     system call is now /dev/random instead of /dev/urandom. This is safer
     on Linux in case the application runs early after the kernel boots,
     but may block needlessly on Linux <= 5.6. Reported by supers1ngular
     (BayLibre).
Add MBEDTLS_PLATFORM_DEV_RANDOM as a compile-time option Document when this is not used. This was the case in TF-PSA-Crypto 1.0.0, but not yet in Mbed TLS 3.6. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com> 2026-02-25 22:12:13 +01:00			`Features`
			`* The device for reading entropy on platforms without a dedicated system`
			`call can now be configured with MBEDTLS_PLATFORM_DEV_RANDOM or`
			`mbedtls_platform_dev_random.`
Change the default from /dev/urandom to /dev/random Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com> 2026-02-25 22:46:43 +01:00
			`Security`
			`* The default device for reading entropy on platforms without a dedicated`
			`system call is now /dev/random instead of /dev/urandom. This is safer`
			`on Linux in case the application runs early after the kernel boots,`
			`but may block needlessly on Linux <= 5.6. Reported by supers1ngular`
			`(BayLibre).`