paragonie/random_compat · critical · Exception

Could not gather sufficient random data

Error message

Could not gather sufficient random data

What it means

This error is thrown by random_compat's libsodium-backed random_bytes() when every internal attempt to obtain random bytes fails, including the final libsodium fallback. It means the PHP environment could not provide cryptographically secure randomness through any available backend, so the library deliberately fails closed instead of returning insecure data.

Solutions

1. Fix the OS-level entropy source: verify /dev/urandom exists and is readable (e.g. mount /dev properly in containers).
2. Upgrade to PHP 7.0+ where random_bytes() is a built-in, which bypasses this polyfill path.
3. Check PHP open_basedir/disable_functions settings are not blocking urandom access.
4. Ensure the paragonie/sodium_compat or libsodium extension is installed and functional if that backend is in play.
5. If the failure is transient entropy starvation, retry after the system RNG is available.

Example fix

// before
$data = random_bytes(32);
// after
try {
    $data = random_bytes(32);
} catch (Exception $e) {
    error_log('No CSPRNG available: ' . $e->getMessage());
    throw $e; // do NOT fall back to insecure randomness
}

// No caller-side check can prevent an environment-level CSPRNG failure;
// detect it early at application bootstrap:
// try { random_bytes(1); } catch (Exception $e) { failHard('No CSPRNG'); }

null

try {
    $data = random_bytes(32);
} catch (Exception $e) {
    // fails closed: never substitute rand()/mt_rand()
    error_log('CSPRNG unavailable: ' . $e->getMessage());
    throw new RuntimeException('Secure randomness unavailable', 0, $e);
}

When it happens

Trigger: Calling random_bytes($n) on a system where PHP 7's CSPRNG is absent, /dev/urandom is unreadable, and Sodium::randombytes_buf() also fails — the function exhausts all backends and reaches the final throw in lib/random_bytes_libsodium.php:87.

Common situations: Running on unusual OSes without /dev/urandom, chrooted or containerized environments missing random device nodes, misconfigured open_basedir restrictions blocking /dev/urandom, or broken PHP builds lacking a working CSPRNG.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• Could not gather sufficient random data
• Could not gather sufficient random data
• There is no suitable CSPRNG installed on your system
• COM does not exist
• Could not gather sufficient random data

AI-assisted analysis of paragonie/random_compat@b5d188cc9d (2026-09-13). Data as JSON: /api/errors/415b1d34ee2461ec. Report an issue: GitHub.

Appendix: source

Thrown at lib/random_bytes_libsodium.php:87

                    ? 1073741824
                    : $bytes - $i;
                $buf .= \Sodium\randombytes_buf($n);
            }
        } else {
            /** @var string|bool $buf */
            $buf = \Sodium\randombytes_buf($bytes);
        }

        if (is_string($buf)) {
            if (RandomCompat_strlen($buf) === $bytes) {
                return $buf;
            }
        }

        /**
         * If we reach here, PHP has failed us.
         */
        throw new Exception(
            'Could not gather sufficient random data'
        );
    }
}

View on GitHub (pinned to b5d188cc9d)