Date: Fri, 12 Jan 2001 20:13:52 +0200 From: Maxim Sobolev <sobomax@FreeBSD.org> To: Warner Losh <imp@harmony.village.org> Cc: current@FreeBSD.org Subject: Re: cvs commit: src/etc crontab rc src/etc/defaults rc.conf src/etc/mtree BSD.root.dist src/libexec Makefile src/libexec/save-entropy Makefile save-entropy.sh Message-ID: <3A5F4960.76BB8A2B@FreeBSD.org> References: <3A5ED913.6B09A21F@FreeBSD.org> <200101120644.f0C6hvI12630@gratis.grondar.za> <200101120534.f0C5YYH96390@earth.backplane.com> <200101120652.f0C6qls78578@harmony.village.org> <200101120711.f0C7B4Y97991@earth.backplane.com> <200101121639.f0CGdjs81328@harmony.village.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Warner Losh wrote: > In message <3A5ED913.6B09A21F@FreeBSD.org> Maxim Sobolev writes: > : I like this idea, but perhaps it would be nice to have more > : fine-grained control over when /dev/random is blocking and when > : not. Why not to add sysctl to switch between blocking/non-blocking > : behaviour (defaulting to non-blocking), so our startup scripts would > : be able to switch /dev/random to be secure at the point when it's > : safe to do (all f/s mounted) much like it copes with > : kern.securelevel. Additionaly it would solve the problem that you > : are not able to use almost anything in single-user mode (less, vi, > : ee etc) w/o feeding /dev/random by hand first. > > That's why I had the first write clause in my statement. The act of > seeing it, which writes to /dev/random, would be enough. No need to > make it more complex than it has to be. Seeding it with *something* (ls, vmstat, date etc) is not equial to seeding it properly, i.e using data with high enough amount of entropy in it. Therefore, such sysctl may be potentially used to determine that random generator is in insecure state and should not be used for anything that require high level of randomness (key generation for example - ssh may check such sysctl and refuse to generate a key or at least warn a user about possible problems). Just my UAH0.02 ;). -Maxim To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3A5F4960.76BB8A2B>