From owner-freebsd-questions Mon Oct 7 11:22:29 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EB00C37B401 for ; Mon, 7 Oct 2002 11:22:27 -0700 (PDT) Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108]) by mx1.FreeBSD.org (Postfix) with ESMTP id C1D7D43E91 for ; Mon, 7 Oct 2002 11:22:26 -0700 (PDT) (envelope-from fgleiser@cactus.fi.uba.ar) Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108]) by cactus.fi.uba.ar (8.12.3/8.12.3) with ESMTP id g97IJq9x009102; Mon, 7 Oct 2002 15:19:53 -0300 (ART) (envelope-from fgleiser@cactus.fi.uba.ar) Date: Mon, 7 Oct 2002 15:19:52 -0300 (ART) From: Fernando Gleiser To: Kevin Oberman Cc: parv , FreeBSD Questions LIST Subject: Re: dilution of /dev/urandom In-Reply-To: <20021007170113.5C7EE5D06@ptavv.es.net> Message-ID: <20021007151207.B8992-100000@cactus.fi.uba.ar> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Status: No, hits=-3.4 required=5.0 tests=IN_REP_TO version=2.31 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Mon, 7 Oct 2002, Kevin Oberman wrote: > > Obviously I would suggest the man pages (man 4 random). /dev/urandom > will never be exhausted. The numbers returned will simply become > progressively less random. (Random enough for most things, but I always > use /dev/random to make keys.) Yes, it is true that urandom reverts back to a pnrg when the entropy pool gets low. *But* IIRC there is only one entrophy pool in the kernel, so /dev/random will stall until the entropy pool get replenished even if you read from urandom only. I need to read the source to be sure, but better safe than sorry :) This means you can DoS some app which *needs* the randomness and reads from /dev/random just by messing around with /dev/urandom. If both devices have separate entrpy pools, this is not an issue (just remember: dont play with /dev/random unless you know what you're doing) > > Both use truly random, external events to generate the entropy > pool. By default, these are generated fairly slowly and the pool is > easily exhausted. This is because the default is VERY paranoid about > your system. Agreed. Fer To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message