paragonie/random_compat · critical · Exception

Could not gather sufficient random data

Error message

Could not gather sufficient random data

What it means

After repeatedly attempting to fetch random data via CAPICOM's Utilities.GetRandom() (looping while $execCount < $bytes), the library gives up and throws. It signals that PHP on this system could not produce enough CSPRNG output through the COM backend — a last-resort failure because returning less data or weak data is never acceptable.

Solutions

1. Verify CAPICOM (CAPICOM.Utilities.1) is installed and registered (regsvr32 capicom.dll) — or accept CAPICOM is EOL and switch backends.
2. Upgrade PHP to >= 7.0 so native random_bytes() is used and random_compat's COM path is skipped.
3. Use a random_compat build backed by mcrypt/openssl or /dev/urandom instead of the COM backend.
4. Check COM instantiation and permissions for the executing user (IIS app pool, service account) and test new COM('CAPICOM.Utilities.1') directly.

Example fix

// before
$bytes = random_bytes(32); // relies on CAPICOM COM backend
// after
try {
    $bytes = random_bytes(32);
} catch (Exception $e) {
    throw new RuntimeException('CSPRNG unavailable: ' . $e->getMessage(), 0, $e);
}
// Preferred long-term fix: run PHP >= 7.0 so native random_bytes() is used.

// No pre-call validation can prevent this; detect backend health instead:
try {
    $probe = random_bytes(1);
} catch (Exception $e) {
    throw new RuntimeException('CSPRNG backend unhealthy: ' . $e->getMessage(), 0, $e);
}

try {
    $bytes = random_bytes(32);
} catch (Exception $e) {
    // Never fall back to non-CSPRNG sources; fail closed and alert
    throw new RuntimeException('Could not generate secure random data', 0, $e);
}

When it happens

Trigger: The do/while loop calling $util->GetRandom() throws or returns unusable data on every iteration until $execCount reaches $bytes; CAPICOM.Utilities.1 not installed/registered on Windows; COM call failures swallowed and retried until exhaustion.

Common situations: Windows Server where CAPICOM is not installed (it is a legacy redistributable not present on modern Windows); 64-bit PHP where the 32-bit CAPICOM COM object cannot be instantiated; restricted COM permissions for the IIS application-pool identity.

Related errors

• There is no suitable CSPRNG installed on your system
• COM does not exist
• Environment misconfiguration: /dev/urandom cannot be read.
• Could not gather sufficient random data
• Could not gather sufficient random data

AI-assisted analysis of paragonie/random_compat@b5d188cc9d (2026-09-13). Data as JSON: /api/errors/a25ee46aedc323c4. Report an issue: GitHub.

Appendix: source

Thrown at lib/random_bytes_com_dotnet.php:87

        /**
         * Let's not let it loop forever. If we run N times and fail to
         * get N bytes of random data, then CAPICOM has failed us.
         */
        do {
            $buf .= base64_decode((string) $util->GetRandom($bytes, 0));
            if (RandomCompat_strlen($buf) >= $bytes) {
                /**
                 * Return our random entropy buffer here:
                 */
                return (string) RandomCompat_substr($buf, 0, $bytes);
            }
            ++$execCount;
        } while ($execCount < $bytes);

        /**
         * If we reach here, PHP has failed us.
         */
        throw new Exception(
            'Could not gather sufficient random data'
        );
    }
}

View on GitHub (pinned to b5d188cc9d)