When to use /dev/random over /dev/urandom in Linux
In which practical situations would one want to use /dev/random in preference to /dev/urandom, and why?


Basically none on a typical desktop or server system. Assuming the PRNG produces cryptographically secure random numbers, there is no reason to use /dev/random instead.

There are a couple of corner cases, however:


You use the random numbers for a one-time pad. In that case if you wanted information theoretic security you should not use pseudorandom numbers. (No real reason to do that in my opinion.)
Early boot on a very low entropy device. The /dev/urandom device cannot guarantee that it has received enough initial entropy, while when using /dev/random that is guaranteed (even if it may block). However, in this case you could use the newer getrandom interface (man page) instead.


Running cryptsetup on first boot of an embedded device is the kind of thing where you would need to consider your options. (Modern desktop and server CPUs tend to include hardware random number generators which are used to seed /dev/urandom.)

There is some work underway to make /dev/urandom block when initial entropy is insufficient, but it may not be possible due to programs which assume it will never block. (See e.g. this LKML thread.)