passbolt/passbolt_api · error · InternalErrorException

Could not generate enough random bytes, please try again…

Error message

Could not generate enough random bytes, please try again later.

What it means

Runtime failure guard in MfaOtpFactory::generateTOTP(): random_bytes() failed to produce enough entropy (it throws Error/TypeError when the source is broken), which is caught and rethrown as an internal error advising to retry later.

Solutions

1. Check that /dev/urandom exists and is readable inside the environment (e.g. ls -l /dev/urandom).
2. Wait or warm up entropy sources on virtualized hosts that boot with low entropy.
3. Check open_basedir/disable_functions PHP settings do not restrict the random source.
4. Retry the TOTP setup after the environment issue is resolved.

if (!is_readable('/dev/urandom') && PHP_OS === 'Linux') { error_log('CSPRNG source unavailable'); }

try { $secret = MfaOtpFactory::generateTOTP($uac); } catch (InternalErrorException $e) { // retry after checking /dev/urandom availability }

When it happens

Trigger: Calling MfaOtpFactory::generateTOTP on a system where the random source (/dev/urandom or equivalent) is unavailable or exhausted, so random_bytes() throws.

Common situations: Containerized or VM environments with low entropy at boot, restricted /dev/urandom access, or hardened open_basedir settings blocking the random source.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• Could not generate TOTP secret, please try again later.
• MFA setting OTP provisioning uri is not set.
• Something went wrong when validating the one-time password.
• A Duo state cookie is required.
• A Duo state cookie is required.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/afa228fe21dc5bf8. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOtpFactory.php:76

    /**
     * Generate a random TOTP
     *
     * @param \App\Utility\UserAccessControl $uac user access control
     * @return string provisioning uri
     */
    public static function generateTOTP(UserAccessControl $uac): string
    {
        $secretLength = self::getAndSanitizeSecretLengthFromConfig();
        try {
            $secret = trim(Base32::encode(random_bytes($secretLength)), '='); // some random bytes Base32 without padding
        } catch (TypeError $exception) {
            throw new InternalErrorException(
                'Could not generate TOTP secret, please try again later.',
                500,
                $exception
            );
        } catch (Exception $exception) {
            throw new InternalErrorException(
                'Could not generate enough random bytes, please try again later.',
                500,
                $exception
            );
        }

        $totp = TOTP::create($secret);
        $totp->setLabel($uac->getUsername()); // label: string shown below the code digits
        $totp->setIssuer(self::getIssuer()); // issuer: string shown above the code digits

        return $totp->getProvisioningUri();
    }

    /**
     * @return int
     */
    public static function getAndSanitizeSecretLengthFromConfig(): int
    {

View on GitHub (pinned to 31c1bbc10f)