[lkml]   [2001]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: /dev/random in 2.4.6

> Alex Bligh - linux-kernel wrote:
>> OK; well in which case it doesn't solve the problem.
> I don't see why not. Apply this change, and use /dev/urandom.
> You'll never block, and the outputs should be thoroughly unpredictable.
> What's missing?

See message to Oliver - para on waiting for sufficient entropy;
/dev/urandom (before that arrives) is just as theoretically
vulnerable as before.

> (I don't see why so many people use /dev/random rather than /dev/urandom.
> I harbor suspicions that this is a misunderstanding about the properties
> of pseudorandom number generation.)

Things like (from the manpage):

When read, the /dev/random device will only return random
bytes within the estimated number of bits of noise in the
entropy pool. /dev/random should be suitable for uses
that need very high quality randomness such as one-time
pad or key generation. When the entropy pool is empty,
reads to /dev/random will block until additional environ­
mental noise is gathered.

When read, /dev/urandom device will return as many bytes
as are requested. As a result, if there is not sufficient
entropy in the entropy pool, the returned values are theo­
retically vulnerable to a cryptographic attack on the
algorithms used by the driver. Knowledge of how to do
this is not available in the current non-classified liter­
ature, but it is theoretically possible that such an
attack may exist. If this is a concern in your applica­
tion, use /dev/random instead.

So writers of ssh, ssl etc. all go use /dev/random, which is not
'theoretically vulnerable to a cryptographic attack'. This means,
in practice, that they are dysfunctional on some headless systems
without Robert's patch. Robert's patch may make them slightly
less 'perfect', but not as imperfect as using /dev/urandom instead.
Using /dev/urandom has another problem: Do we expect all applications
now to have a compile option 'Are you using this on a headless
system in which case you might well want to use /dev/urandom
instead of /dev/random?'. By putting a config option in the kernel,
this can be set ONCE and only degrade behaviour to the minimal
amount possible.

Alex Bligh
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:17    [W:0.221 / U:2.208 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site