From owner-freebsd-current  Sun Jul 23  5:53:58 2000
Delivered-To: freebsd-current@freebsd.org
Received: from matrix.42.org (matrix.42.org [194.246.250.200])
	by hub.freebsd.org (Postfix) with ESMTP id 9A29837BC00
	for <freebsd-current@freebsd.org>; Sun, 23 Jul 2000 05:53:53 -0700 (PDT)
	(envelope-from sec@42.org)
Received: (from sec@localhost)
	by matrix.42.org (8.8.8/8.8.5) id OAA28448
	(sender <sec>); Sun, 23 Jul 2000 14:53:50 +0200 (CEST)
Date: Sun, 23 Jul 2000 14:53:50 +0200 (CEST)
Message-Id: <200007231253.OAA28448@matrix.42.org>
From: Stefan `Sec` Zehl <sec@require-re.42.org>
To: freebsd-current@freebsd.org
Subject: Re: randomdev entropy gathering is really weak 
Summary: 
Expires: 
References: <3056.964340700@critter.freebsd.dk>
Followup-To: 
Distribution: 
Organization: Seeking the question
Keywords: 
Cc: 
Sender: owner-freebsd-current@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Poul-Henning Kamp  <phk@critter.freebsd.dk> wrote:
> In message <Pine.BSF.4.21.0007230107130.81127-100000@freefall.freebsd.org>, Kri
> s Kennaway writes:
> >On Sun, 23 Jul 2000, Poul-Henning Kamp wrote:
> >
> >> Obviously, if you need more randomness than a stock FreeBSD system
> >> can provide you with, you add hardware to give you more randomness.
> >
> >This won't help if it's fed through Yarrow.
> 
> Nobody has said anything about forcing you to use Yarrow, have they ?

If FreeBSD delivers with it, it will get used.
I think Kris has a valid concern. If I assume that I will get good
randomness from /dev/random, and I don't, there is potential danger.

Assume I want to encrypt a message by XOR'ing with randomness.

If I then exchange my keys securely, the message is uncrackable.

With the current approach it has a 256bits key. This is, in my eyes, not
good. Although yarrow is nice, It's suited for any kind of key
generation.

> I have not seen any new information in the last N emails from you.

This is because his concerns aren't addressed yet.

CU,
    Sec
-- 
Das Usenet ist so ein wunderbares, aber zerbrechliches Medium und so viele
treten es so in den Dreck und machen es unbenutzbar - sei es durch Absicht
oder Gedankenlosigkeit, was vom Ergebnis das gleiche ist.  -- Bettina Fink


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-current" in the body of the message