From owner-freebsd-bugs@freebsd.org Mon Feb 25 03:43:53 2019 Return-Path: Delivered-To: freebsd-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A063C151ACC3 for ; Mon, 25 Feb 2019 03:43:53 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 17F2F70F26 for ; Mon, 25 Feb 2019 03:43:53 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.ysv.freebsd.org (Postfix) id C7CD2151ACC2; Mon, 25 Feb 2019 03:43:52 +0000 (UTC) Delivered-To: bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B4F92151ACC1 for ; Mon, 25 Feb 2019 03:43:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.ysv.freebsd.org (mxrelay.ysv.freebsd.org [IPv6:2001:1900:2254:206a::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.ysv.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4E6E970F1D for ; Mon, 25 Feb 2019 03:43:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.ysv.freebsd.org (Postfix) with ESMTPS id 7AD37AF4F for ; Mon, 25 Feb 2019 03:43:51 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id x1P3hpPx078394 for ; Mon, 25 Feb 2019 03:43:51 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id x1P3hpwF078391 for bugs@FreeBSD.org; Mon, 25 Feb 2019 03:43:51 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 236010] rand(3) values strongly correlate with time while this doesn't have to be the case Date: Mon, 25 Feb 2019 03:43:51 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: misc X-Bugzilla-Version: 12.0-STABLE X-Bugzilla-Keywords: needs-qa X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: koobs@FreeBSD.org X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: secteam@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback? X-Bugzilla-Changed-Fields: flagtypes.name assigned_to cc bug_status keywords bug_severity Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Feb 2019 03:43:53 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D236010 Kubilay Kocak changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |maintainer-feedback?(sectea | |m@FreeBSD.org) Assignee|bugs@FreeBSD.org |secteam@FreeBSD.org CC| |secteam@FreeBSD.org, | |security@FreeBSD.org Status|New |Open Keywords| |needs-qa Severity|Affects Only Me |Affects Some People --- Comment #1 from Kubilay Kocak --- This sounds like a request to improve the algorithm, not necessarily achiev= ing 'cryptographically secure', given these details from man rand(3): rand, srand, sranddev, rand_r =E2=80=93 bad random number generator The functions described in this manual page are not cryptographically secure. Cryptographic applications should use arc4random(3) instead. These interfaces are obsoleted by random(3). For better generator quality, use random(3) or lrand48(3). --=20 You are receiving this mail because: You are the assignee for the bug.=