Arc4random | Is OpenBSD secure?
Linux was the first operating system to expose a kernel-powered CSPRNG to userland, thanks to Theodore Ts’o, who committed added one in Linux 1.3.30, in September 1995. This was done in collaboration with Colin Plumb, who designed the random number generator in the original PGP code base, and Dale Worley. It relied on gathering random signals (interrupts, timers, latencies, inputs, …), and mixing them via MD5.
OpenBSD added /dev/random and /dev/urandom to its codebase in March 1996, based on Ts’o work, and it landed in OpenBSD 2.1 in June 1997.
The arc4random function was added in December 1996 to OpenBSD 2.1’s libc. It has several advantages over /dev/random and /dev/urandom: it can’t fail, it’s available in chroots, is thread-safe, it has better performances since it’s only asking the kernel for entropy to (re)seed its keystream, … making it easy to use for developers.
The libc’s arc4random was moved from RC4 to ChaCha20 in October 2013, and so did its kernel counterpart in November 2013; they both landed in OpenBSD 5.5 in May 2014.
