{"record":{"id":"afa228fe21dc5bf8","repo":"passbolt/passbolt_api","slug":"could-not-generate-enough-random-bytes-please-try-again","errorCode":null,"errorMessage":"Could not generate enough random bytes, please try again later.","messagePattern":"Could not generate enough random bytes, please try again later\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOtpFactory.php","lineNumber":76,"sourceCode":"    /**\n     * Generate a random TOTP\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac user access control\n     * @return string provisioning uri\n     */\n    public static function generateTOTP(UserAccessControl $uac): string\n    {\n        $secretLength = self::getAndSanitizeSecretLengthFromConfig();\n        try {\n            $secret = trim(Base32::encode(random_bytes($secretLength)), '='); // some random bytes Base32 without padding\n        } catch (TypeError $exception) {\n            throw new InternalErrorException(\n                'Could not generate TOTP secret, please try again later.',\n                500,\n                $exception\n            );\n        } catch (Exception $exception) {\n            throw new InternalErrorException(\n                'Could not generate enough random bytes, please try again later.',\n                500,\n                $exception\n            );\n        }\n\n        $totp = TOTP::create($secret);\n        $totp->setLabel($uac->getUsername()); // label: string shown below the code digits\n        $totp->setIssuer(self::getIssuer()); // issuer: string shown above the code digits\n\n        return $totp->getProvisioningUri();\n    }\n\n    /**\n     * @return int\n     */\n    public static function getAndSanitizeSecretLengthFromConfig(): int\n    {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOtpFactory.php#L58-L94","documentation":"Runtime failure guard in MfaOtpFactory::generateTOTP(): random_bytes() failed to produce enough entropy (it throws Error/TypeError when the source is broken), which is caught and rethrown as an internal error advising to retry later.","triggerScenarios":"Calling MfaOtpFactory::generateTOTP on a system where the random source (/dev/urandom or equivalent) is unavailable or exhausted, so random_bytes() throws.","commonSituations":"Containerized or VM environments with low entropy at boot, restricted /dev/urandom access, or hardened open_basedir settings blocking the random source.","solutions":["Check that /dev/urandom exists and is readable inside the environment (e.g. ls -l /dev/urandom).","Wait or warm up entropy sources on virtualized hosts that boot with low entropy.","Check open_basedir/disable_functions PHP settings do not restrict the random source.","Retry the TOTP setup after the environment issue is resolved."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if (!is_readable('/dev/urandom') && PHP_OS === 'Linux') { error_log('CSPRNG source unavailable'); }","typeGuard":null,"tryCatchPattern":"try { $secret = MfaOtpFactory::generateTOTP($uac); } catch (InternalErrorException $e) { // retry after checking /dev/urandom availability }","preventionTips":["Ensure /dev/urandom is available and readable in containers/VMs.","Configure adequate entropy (e.g. haveged on legacy hosts).","Do not restrict random source via open_basedir/disable_functions."],"tags":["mfa","totp","entropy","random-bytes"],"backgroundTag":"missing-env-var","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}