diff --git a/abe/cpabe/tkn20/internal/tkn/bk.go b/abe/cpabe/tkn20/internal/tkn/bk.go
index c0f58450..e68897a3 100644
--- a/abe/cpabe/tkn20/internal/tkn/bk.go
+++ b/abe/cpabe/tkn20/internal/tkn/bk.go
@@ -78,7 +78,7 @@ func DeriveAttributeKeysCCA(rand io.Reader, sp *SecretParams, attrs *Attributes)
 
 func EncryptCCA(rand io.Reader, public *PublicParams, policy *Policy, msg []byte) ([]byte, error) {
 	seed := make([]byte, macKeySeedSize)
-	_, err := rand.Read(seed)
+	_, err := io.ReadFull(rand, seed)
 	if err != nil {
 		return nil, err
 	}
diff --git a/blindsign/blindrsa/blindrsa.go b/blindsign/blindrsa/blindrsa.go
index 21375585..f0b9fdae 100644
--- a/blindsign/blindrsa/blindrsa.go
+++ b/blindsign/blindrsa/blindrsa.go
@@ -183,7 +183,7 @@ func (v RSAVerifier) Blind(random io.Reader, message []byte) ([]byte, blindsign.
 	}
 
 	salt := make([]byte, v.hash.Size())
-	_, err := random.Read(salt)
+	_, err := io.ReadFull(random, salt)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/kem/frodo/frodo640shake/frodo.go b/kem/frodo/frodo640shake/frodo.go
index eac7bd73..8cdb88e2 100644
--- a/kem/frodo/frodo640shake/frodo.go
+++ b/kem/frodo/frodo640shake/frodo.go
@@ -160,7 +160,9 @@ func generateKeyPair(rand io.Reader) (*PublicKey, *PrivateKey, error) {
 func (pk *PublicKey) EncapsulateTo(ct []byte, ss []byte, seed []byte) {
 	if seed == nil {
 		seed = make([]byte, EncapsulationSeedSize)
-		_, _ = cryptoRand.Read(seed[:])
+        if _, err := cryptoRand.Read(seed[:]); err != nil {
+			panic(err)
+		}
 	}
 	if len(seed) != EncapsulationSeedSize {
 		panic("seed must be of length EncapsulationSeedSize")
diff --git a/kem/kyber/kyber1024/kyber.go b/kem/kyber/kyber1024/kyber.go
index 082c0e64..42858452 100644
--- a/kem/kyber/kyber1024/kyber.go
+++ b/kem/kyber/kyber1024/kyber.go
@@ -106,7 +106,9 @@ func GenerateKeyPair(rand io.Reader) (*PublicKey, *PrivateKey, error) {
 func (pk *PublicKey) EncapsulateTo(ct, ss []byte, seed []byte) {
 	if seed == nil {
 		seed = make([]byte, EncapsulationSeedSize)
-		cryptoRand.Read(seed[:])
+		if _, err := cryptoRand.Read(seed[:]); err != nil {
+			panic(err)
+		}
 	} else {
 		if len(seed) != EncapsulationSeedSize {
 			panic("seed must be of length EncapsulationSeedSize")
diff --git a/kem/kyber/kyber512/kyber.go b/kem/kyber/kyber512/kyber.go
index 2e5b9fd0..c250d78c 100644
--- a/kem/kyber/kyber512/kyber.go
+++ b/kem/kyber/kyber512/kyber.go
@@ -106,7 +106,9 @@ func GenerateKeyPair(rand io.Reader) (*PublicKey, *PrivateKey, error) {
 func (pk *PublicKey) EncapsulateTo(ct, ss []byte, seed []byte) {
 	if seed == nil {
 		seed = make([]byte, EncapsulationSeedSize)
-		cryptoRand.Read(seed[:])
+		if _, err := cryptoRand.Read(seed[:]); err != nil {
+			panic(err)
+		}
 	} else {
 		if len(seed) != EncapsulationSeedSize {
 			panic("seed must be of length EncapsulationSeedSize")
diff --git a/kem/kyber/kyber768/kyber.go b/kem/kyber/kyber768/kyber.go
index e9b025d4..832d9b37 100644
--- a/kem/kyber/kyber768/kyber.go
+++ b/kem/kyber/kyber768/kyber.go
@@ -106,7 +106,9 @@ func GenerateKeyPair(rand io.Reader) (*PublicKey, *PrivateKey, error) {
 func (pk *PublicKey) EncapsulateTo(ct, ss []byte, seed []byte) {
 	if seed == nil {
 		seed = make([]byte, EncapsulationSeedSize)
-		cryptoRand.Read(seed[:])
+		if _, err := cryptoRand.Read(seed[:]); err != nil {
+			panic(err)
+		}
 	} else {
 		if len(seed) != EncapsulationSeedSize {
 			panic("seed must be of length EncapsulationSeedSize")
diff --git a/kem/kyber/templates/pkg.templ.go b/kem/kyber/templates/pkg.templ.go
index 4e56e0f5..22eb1fd7 100644
--- a/kem/kyber/templates/pkg.templ.go
+++ b/kem/kyber/templates/pkg.templ.go
@@ -110,7 +110,9 @@ func GenerateKeyPair(rand io.Reader) (*PublicKey, *PrivateKey, error) {
 func (pk *PublicKey) EncapsulateTo(ct, ss []byte, seed []byte) {
 	if seed == nil {
 		seed = make([]byte, EncapsulationSeedSize)
-		cryptoRand.Read(seed[:])
+		if _, err := cryptoRand.Read(seed[:]); err != nil {
+			panic(err)
+		}
 	} else {
 		if len(seed) != EncapsulationSeedSize {
 			panic("seed must be of length EncapsulationSeedSize")
diff --git a/kem/sike/sikep434/sike.go b/kem/sike/sikep434/sike.go
index a490ece5..a24335c1 100644
--- a/kem/sike/sikep434/sike.go
+++ b/kem/sike/sikep434/sike.go
@@ -130,7 +130,9 @@ func (*scheme) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) {
 
 func (sch *scheme) Encapsulate(pk kem.PublicKey) (ct []byte, ss []byte, err error) {
 	var seed [EncapsulationSeedSize]byte
-	cryptoRand.Read(seed[:])
+	if _, err := cryptoRand.Read(seed[:]); err != nil {
+		return nil, nil, err
+	}
 	return sch.EncapsulateDeterministically(pk, seed[:])
 }
 
diff --git a/kem/sike/sikep503/sike.go b/kem/sike/sikep503/sike.go
index b4e64ff4..363f1f24 100644
--- a/kem/sike/sikep503/sike.go
+++ b/kem/sike/sikep503/sike.go
@@ -130,7 +130,9 @@ func (*scheme) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) {
 
 func (sch *scheme) Encapsulate(pk kem.PublicKey) (ct []byte, ss []byte, err error) {
 	var seed [EncapsulationSeedSize]byte
-	cryptoRand.Read(seed[:])
+	if _, err := cryptoRand.Read(seed[:]); err != nil {
+		return nil, nil, err
+	}
 	return sch.EncapsulateDeterministically(pk, seed[:])
 }
 
diff --git a/kem/sike/sikep751/sike.go b/kem/sike/sikep751/sike.go
index 34c95f22..a39773ba 100644
--- a/kem/sike/sikep751/sike.go
+++ b/kem/sike/sikep751/sike.go
@@ -130,7 +130,9 @@ func (*scheme) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) {
 
 func (sch *scheme) Encapsulate(pk kem.PublicKey) (ct []byte, ss []byte, err error) {
 	var seed [EncapsulationSeedSize]byte
-	cryptoRand.Read(seed[:])
+	if _, err := cryptoRand.Read(seed[:]); err != nil {
+		return nil, nil, err
+	}
 	return sch.EncapsulateDeterministically(pk, seed[:])
 }
 
diff --git a/kem/sike/templates/pkg.templ.go b/kem/sike/templates/pkg.templ.go
index eef157ce..afa05f22 100644
--- a/kem/sike/templates/pkg.templ.go
+++ b/kem/sike/templates/pkg.templ.go
@@ -135,7 +135,9 @@ func (*scheme) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) {
 
 func (sch *scheme) Encapsulate(pk kem.PublicKey) (ct []byte, ss []byte, err error) {
 	var seed [EncapsulationSeedSize]byte
-	cryptoRand.Read(seed[:])
+	if _, err := cryptoRand.Read(seed[:]); err != nil {
+		return nil, nil, err
+	}
 	return sch.EncapsulateDeterministically(pk, seed[:])
 }