Hi everyone. I am studying the source code about PRNG and find that there are 2 small problems. I don't know whether it's for your carelessness or for my ignorant.
Target: md_rand.c in openssl-1.0.0c 1>:State was stirred only on the first successful invocation to ssleay_rand_bytes(). This leads to the situation that following-up RAND_add() has no effect on the following state, that is from state_index in the last ssleay_rand_bytes(). Therefore, the last ssleay_rand_add() increase no entropy on the following ssleay_rand_bytes() which I think is not desirable. I suggest doing a stirring on state everytime ssleay_rand_bytes() is called. At least it doesn't reduce the security. 2>:In ssleay_rand_bytes(), md _count[1] increases by 1 everytime when the function is invoked, and md_c[0] keeps still throughout the loop. While in ssleay_rand_add(), md_c[0] increases by 1 every loop, and md _count[0] increases according to the number of data added to state. The function ssleay_rand_bytes() and ssleay_rand_add() behave differently as regards the counter, here md _count[0] and md _count[1] respectively. Best Regards. Guan Le, State Key Laboratory Of Information Security (SKLOIS), China ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
