> From: Jeffrey Altman <[EMAIL PROTECTED]>
>
> jaltman> At least one independent source submitted the fix
> jaltman>
> jaltman> LMSTR -> LPWSTR
>
> And that also allows the L"..." syntax? Is that guaranteed to work
> everywhere or will we have another battle about this after beta3 gets
> out (should happen tomorrow if everythings goes well). If this would
> make it break for those using Mingw32 or CygWin to build, I'd prefer
> to keep it disabled.
>
> I'll run a test with that using VC6.
The L syntax should work everywhere (to my knowledge). That syntax is
used to specify Wide String Constants. There is no other syntax to do
this that I have ever scene. LPWSTR are wide strings. (aka, Unicode)
I would send e-mail to the guy in Singapore with the mingw32 compiler
and ask him to check it for you before you apply the patch. The
problem is that if we don't do this AND make some changes to the
entropy values passed to RAND_add(), RAND_status() will always fail on
NT4.
> jaltman> The last thing that needs to be done is to re-examine each
> jaltman> call to RAND_add() to determine how many random bits of data
> jaltman> are supplied by each block of data. Currently, 0.0 is used
> jaltman> everywhere which means that the entroy count is never
> jaltman> increased to a level that indicates that the data has been
> jaltman> initialized.
>
> Using 0.0 everywhere is not terribly good, you're right about that.
> Using it for RAND_screen() (I saw some message from you commenting on
> that) is understandable, since the quality of a blank screen (the
> worst case, which is what one must go for, security-wise) as entropy
> is exactly that, 0.
I agree with you regarding RAND_screen(). BUT RAND_screen() calls
RAND_poll() so after a RAND_screen() call it is possible that the
'entropy' is greater than ENTROPY_NEEDED even though 'initialized' is
false. Perhaps the 'initialized' test should be replaced by the
ENTROPY_NEEDED test in a future build.
> BTW, you should mail things like this to openssl-dev instead of
> directly to me. I'm not the sole developer of OpenSSL and I have no
> desire to be that. I just happen to be the release-master and
> therefore keep a good eye on how things develop, leaving it to the
> others to concentrate on the deeper issues for a while.
Understood.
Jeffrey Altman * Sr.Software Designer
The Kermit Project * Columbia University
612 West 115th St * New York, NY * 10025 * USA
http://www.kermit-project.org/ * [EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
