ethereum/go-ethereum · critical

reading from crypto/rand failed:

Error message

reading from crypto/rand failed: 

What it means

EncryptDataV3 derives a key with scrypt and needs 32 random bytes of salt from crypto/rand before KDF. If io.ReadFull(rand.Reader, salt) fails it panics immediately with 'reading from crypto/rand failed: ' plus the cause — V3 keystore encryption cannot proceed without a fresh random salt, so the library treats a broken entropy source as fatal.

Source

Thrown at accounts/keystore/passphrase.go:143

			//lint:ignore ST1005 This is a message for the user
			return fmt.Errorf(msg, tmpName, err)
		}
	}
	return os.Rename(tmpName, filename)
}

func (ks keyStorePassphrase) JoinPath(filename string) string {
	if filepath.IsAbs(filename) {
		return filename
	}
	return filepath.Join(ks.keysDirPath, filename)
}

// EncryptDataV3 encrypts the data given as 'data' with the password 'auth'.
func EncryptDataV3(data, auth []byte, scryptN, scryptP int) (CryptoJSON, error) {
	salt := make([]byte, 32)
	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
		panic("reading from crypto/rand failed: " + err.Error())
	}
	derivedKey, err := scrypt.Key(auth, salt, scryptN, scryptR, scryptP, scryptDKLen)
	if err != nil {
		return CryptoJSON{}, err
	}
	encryptKey := derivedKey[:16]

	iv := make([]byte, aes.BlockSize) // 16
	if _, err := io.ReadFull(rand.Reader, iv); err != nil {
		panic("reading from crypto/rand failed: " + err.Error())
	}
	cipherText, err := aesCTRXOR(encryptKey, data, iv)
	if err != nil {
		return CryptoJSON{}, err
	}
	mac := crypto.Keccak256(derivedKey[16:32], cipherText)

	scryptParamsJSON := make(map[string]interface{}, 5)

View on GitHub (pinned to 6bb0588ad8)

Solutions

1. Provide a working OS entropy source: mount /dev/urandom correctly in the container.
2. On VMs add virtio-rng or install haveged.
3. Adjust seccomp/AppArmor policies to allow getrandom(2).
4. Re-run the account creation after fixing entropy; no state is corrupted because the panic happens before any file write.

func entropyCheck() error {
	b := make([]byte, 8)
	if _, err := rand.Read(b); err != nil { // crypto/rand
		return fmt.Errorf("crypto/rand unusable: %w", err)
	}
	return nil
}
// call at startup before any keystore operations

When it happens

Trigger: Creating or updating a keystore account (newAccount, updateAccountPassword, ExportKey...) on a system where crypto/rand reads fail: /dev/urandom unavailable, getrandom(2) blocked by seccomp, or entropy exhaustion in a constrained VM.

Common situations: Minimal Docker/chroot images missing a proper /dev, restrictive sandbox profiles, very early boot on entropy-starved kernels, or exotic OSes with unimplemented getrandom.

Related errors

• Could not create random uuid: %v
• key generation: could not read from random source:
• key generation: ecdsa.GenerateKey failed:
• nil chainID
• error decoding contract deployer hex %s: %v

AI-assisted analysis of ethereum/go-ethereum@6bb0588ad8 (2026-08-15). Data as JSON: /api/errors/2537f30bce39d451. Report an issue: GitHub.