/dev/random does block "if you don't have enough entropy" (in contrast to /dev/urandom, which doesn't). The only difference is that getrandom() doesn't require

/dev/random does block "if you don't have enough entropy" (in contrast to /dev/urandom, which doesn't). The only difference is that getrandom() doesn't require a file descriptor to use. Note that "if you don't have enough entropy" is not based on any rigorous formal analysis, which is why /dev/urandom has been recommended for a long time, and why the entire concept of blocking randomness syscalls is controversial in kernel-land: https://lwn.net/Articles/800509/ https://lwn.net/Articles/800509/