>
> Some well known applications use SSLeay with an uninitialized random
> number generator. SSLeay interally adds data such as the time and pid
> to the PRNG. Unless the machine in question happens to have /dev/random,
> that results in a ridiculously insecure system -- as everybody should
> know since Netscape's disaster four years ago.
> The randfile.c functions could also have a better interface. There
> should be a function RAND_init() which would take a filename or NULL
> (so as to use the default file .rand), place a lock on that file, read
> the data, add them to the PRNG and imediately write the current state
> back and then release the lock.
There's a nice random() library at Counterpane one can use instead of
SSLeay's one.
> An application would have to call that function on startup and on
> exit. If the .rand (or other) file does not exist, RAND_init() would
> have to read data from system ressources to initialize the PRNG.
There's a method (function call) to gather random state in the system
continuously.
> Comments?
Personally I'm waiting for a local team to make statements on
"reasonable business risk" using SSLeay/OpenSSL.
Vadim Fedukovich
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
