The source code for pg_crypto module mentions an option to build without cryptographically-strong random generation.


  • Generate random bits. pg_backend_random() will do here, we don't promis

  • UUIDs to be cryptographically random, when built with

  • --disable-strong-random.


Discussed further in this thread.

In the particular build I may be using, how can I detect if the strong random feature is enable or disabled?


--disable-strong-random is a PostgreSQL configuration option available in the ./configure script in the source code. You could check to see if your version of PostgreSQL and the associated contrib modules were built with it by using pg_config --configure and looking to see if that particular flag was passed in as part of the config process. Though as it says in the thread that was linked, no reasonable production platform would use that flag, so odds are that you've got a cryptographically random build.


configure fails

At least as of Postgres 10 beta, you can look for configure to fail. If you have not given permission for the strong-random to be omitted (via a configure setting), then Postgres built without strong-random will fail during configure.

To quote the 10 beta doc:

• Add more robust random number generators to be used for cryptographic secure uses (Magnus Hagander, Michael Paquier, Heikki Linnakangas)

If no strong random number generator can be found, configure will fail unless the configure --disable-strong-random is used. However, with this option, pgcrypto functions requiring a strong random number generator will be disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.