From owner-freebsd-current Sun Jun 18 19:53:28 2000 Delivered-To: freebsd-current@freebsd.org Received: from rover.village.org (rover.village.org [204.144.255.49]) by hub.freebsd.org (Postfix) with ESMTP id AFE5437BB43 for ; Sun, 18 Jun 2000 19:53:18 -0700 (PDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (harmony.village.org [10.0.0.6]) by rover.village.org (8.9.3/8.9.3) with ESMTP id UAA31807; Sun, 18 Jun 2000 20:53:14 -0600 (MDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id UAA52694; Sun, 18 Jun 2000 20:51:50 -0600 (MDT) Message-Id: <200006190251.UAA52694@harmony.village.org> To: Peter Jeremy Subject: Re: mktemp() patch Cc: current@FreeBSD.ORG In-reply-to: Your message of "Mon, 19 Jun 2000 12:46:09 +1000." <00Jun19.124610est.115250@border.alcanet.com.au> References: <00Jun19.124610est.115250@border.alcanet.com.au> <394124C3.221E61BC@vangelderen.org> <200006081724.TAA00705@grimreaper.grondar.za> <394124C3.221E61BC@vangelderen.org> <200006190201.UAA52489@harmony.village.org> Date: Sun, 18 Jun 2000 20:51:50 -0600 From: Warner Losh Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG In message <00Jun19.124610est.115250@border.alcanet.com.au> Peter Jeremy writes: : On 2000-Jun-19 12:03:40 +1000, Warner Losh wrote: : >In message <394124C3.221E61BC@vangelderen.org> "Jeroen C. van Gelderen" writes: : >: Pseudo random numbers are so cheap (or they should be) that you : >: just don't want to try and 'optimize' here. It is much better to : >: be conservative and use a good PRNG until it *proves* to be very : >: problematic. : > : >I disagree with this strongly. PRNG have proven time and time again : >to weaken security due to their less than random nature. It is my : >judgement that going down this path would be very bad, especially when : >cryptographically strong random number generators exist and are part : >of the base FreeBSD system. We should just use those... : : The PRNG in question is arc4random() - which AFAIK rates as : "cryptographically strong". I don't believe that mktemp(3) warrants : the use of /dev/random (or even /dev/urandom). I think we're in agreement. I had thought I read it as "use random(3)" for some reason.... Warner To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message