From owner-freebsd-current Sun Jul 23 5:53:58 2000 Delivered-To: freebsd-current@freebsd.org Received: from matrix.42.org (matrix.42.org [194.246.250.200]) by hub.freebsd.org (Postfix) with ESMTP id 9A29837BC00 for <freebsd-current@freebsd.org>; Sun, 23 Jul 2000 05:53:53 -0700 (PDT) (envelope-from sec@42.org) Received: (from sec@localhost) by matrix.42.org (8.8.8/8.8.5) id OAA28448 (sender <sec>); Sun, 23 Jul 2000 14:53:50 +0200 (CEST) Date: Sun, 23 Jul 2000 14:53:50 +0200 (CEST) Message-Id: <200007231253.OAA28448@matrix.42.org> From: Stefan `Sec` Zehl <sec@require-re.42.org> To: freebsd-current@freebsd.org Subject: Re: randomdev entropy gathering is really weak Summary: Expires: References: <3056.964340700@critter.freebsd.dk> Followup-To: Distribution: Organization: Seeking the question Keywords: Cc: Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Poul-Henning Kamp <phk@critter.freebsd.dk> wrote: > In message <Pine.BSF.4.21.0007230107130.81127-100000@freefall.freebsd.org>, Kri > s Kennaway writes: > >On Sun, 23 Jul 2000, Poul-Henning Kamp wrote: > > > >> Obviously, if you need more randomness than a stock FreeBSD system > >> can provide you with, you add hardware to give you more randomness. > > > >This won't help if it's fed through Yarrow. > > Nobody has said anything about forcing you to use Yarrow, have they ? If FreeBSD delivers with it, it will get used. I think Kris has a valid concern. If I assume that I will get good randomness from /dev/random, and I don't, there is potential danger. Assume I want to encrypt a message by XOR'ing with randomness. If I then exchange my keys securely, the message is uncrackable. With the current approach it has a 256bits key. This is, in my eyes, not good. Although yarrow is nice, It's suited for any kind of key generation. > I have not seen any new information in the last N emails from you. This is because his concerns aren't addressed yet. CU, Sec -- Das Usenet ist so ein wunderbares, aber zerbrechliches Medium und so viele treten es so in den Dreck und machen es unbenutzbar - sei es durch Absicht oder Gedankenlosigkeit, was vom Ergebnis das gleiche ist. -- Bettina Fink To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message