On Wed, Apr 29, 2009 at 4:01 PM, <ksreedha...@gmail.com> wrote: > > In the link you have sent it is stated that, > > "The initial value of XKEY is derived using the following procedure. > > We obtain 1024 bytes from the system random number generator. On > Windows XP SP 2, we call the CryptGenRandom function in the CryptoAPI. > On Solaris, HP-UX, Linux, and Mac OS X, we read from the special > device /dev/urandom." > > So, system random number generator (which is used for seed) is not > FIPS approved RNG and continuous tests have to be performed on this > right.
No. We use /dev/urandom as an entropy source, not as an RNG. The fact that /dev/urandom is an RNG is irrelevant here. The continuous RNG test does not apply to entropy sources. To see this point, consider the other entropy sources we use, such as the current timestamp and the names, values, and memory addresses of all the environment variables. It should be clear that the continuous RNG test cannot be applied to entropy sources. Finally, I want to reiterate what I said in my previous reply: ... the continuous RNG test is performed by the crypto module itself, rather than by the user of the crypto module. So you don't need to perform the continuous RNG test. Wan-Teh -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
