paragonie/random_compat · critical · Exception

Could not gather sufficient random data

Error message

Could not gather sufficient random data

What it means

Identical to error 20 but for the libsodium-legacy backend: random_bytes() has exhausted all earlier entropy sources and the final Sodium::randombytes_buf() call failed or returned false, so the library throws. random_compat intentionally fails closed when no cryptographically secure source is available.

Solutions

1. Restore a working entropy source: ensure /dev/urandom exists and is readable by the PHP process.
2. Install the libsodium extension (pecl install libsodium) so the fallback backend works.
3. Upgrade to PHP 7.0+ to use the built-in random_bytes().
4. Check open_basedir and disable_functions for restrictions on urandom.
5. Retry only after the environment is fixed; never substitute non-CSPRNG randomness.

Example fix

// before
$iv = random_bytes(16);
// after
try {
    $iv = random_bytes(16);
} catch (Exception $e) {
    error_log('CSPRNG unavailable on this host: ' . $e->getMessage());
    throw $e;
}

// Environment check at bootstrap:
// if (!is_readable('/dev/urandom') && !function_exists('Sodium\randombytes_buf')) {
//     failHard('No secure RNG backend available');
// }

null

try {
    $bytes = random_bytes($n);
} catch (Exception $e) {
    error_log('No secure RNG on legacy host: ' . $e->getMessage());
    throw $e; // fail closed
}

When it happens

Trigger: Calling random_bytes() on a PHP 5.x system where /dev/urandom (via mcrypt or direct read) is unavailable and the libsodium fallback also errors — reaching the throw at lib/random_bytes_libsodium_legacy.php:89.

Common situations: Legacy PHP 5 hosts without mcrypt or libsodium, containers without /dev/urandom, hardened systems where open_basedir blocks random device access, or broken/old libsodium builds.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• Could not gather sufficient random data
• Could not gather sufficient random data
• There is no suitable CSPRNG installed on your system
• COM does not exist
• Could not gather sufficient random data

AI-assisted analysis of paragonie/random_compat@b5d188cc9d (2026-09-13). Data as JSON: /api/errors/6b7ba877b35ea50c. Report an issue: GitHub.

Appendix: source

Thrown at lib/random_bytes_libsodium_legacy.php:89

                $n = ($bytes - $i) > 1073741824
                    ? 1073741824
                    : $bytes - $i;
                $buf .= Sodium::randombytes_buf((int) $n);
            }
        } else {
            $buf .= Sodium::randombytes_buf((int) $bytes);
        }

        if (is_string($buf)) {
            if (RandomCompat_strlen($buf) === $bytes) {
                return $buf;
            }
        }

        /**
         * If we reach here, PHP has failed us.
         */
        throw new Exception(
            'Could not gather sufficient random data'
        );
    }
}

View on GitHub (pinned to b5d188cc9d)