[lkml]   [2001]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: /dev/random in 2.4.6
On Mon, 20 Aug 2001, Chris Friesen wrote:

> The main reason for my comment was the suggestion by Steve Hill that
> /dev/urandom was NOT cryptographically secure. Re-reading it, his comment was
> in the context of generating cryptographic keys, so perhaps I misunderstood what
> he meant.

Sorry - I'm not a cryptography expert, just your average Linux hacker :)

I was under the impression that urandom was considered insecure (hence why
it is not used by ssh, FreeS/WAN, etc), and so was very dubious about just
linking /dev/random to /dev/urandom. However I still had the problem that
being a headless system, there wasn't much entropy (something which had
never been a problem under Cobalt's kernels - presumably they had kludged
/dev/random on the kernel-side).

After various suggestions, and a correction (I now understand urandom to
be secure despite the very theoretical vulnerability), I opted to get
extra entropy from the eepro100 and natsemi network devices.

Anyway, I would consider that the idea of generating entropy purely from
the local console (keyboard / mouse) to be a rather flawed idea - think
how many headless linux servers there are that are running some kind of
cryptographic software. Maybe a compile-time option in the kernel to
change quality of /dev/random would be an idea so that the person
compiling the kernel can decide on the level of the tradeoff between the
quality and speed/amount of randomness... Just a thought anyway.


- Steve Hill
System Administrator Email:
Navaho Technologies Ltd. Tel: +44-870-7034015

... Alcohol and calculus don't mix - Don't drink and derive! ...

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:57    [W:0.099 / U:0.912 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site