In message <[EMAIL PROTECTED]> on Thu, 20 Nov 2003 22:11:57 -0800, Brian Hatch <[EMAIL PROTECTED]> said:
bri> bri> >mgaudichet> Do you have a better solution than above (e.g. hardcode bri> >mgaudichet> some kind of random data and use it with RAND_seed()...), bri> >mgaudichet> or does it seem ok to you ? bri> > bri> >Never hardcode any "randomness". Such habits can safely be called a bri> >sin, if you believe in that. bri> bri> Unless you explicitly don't care about strong crypto at all. For bri> example when building SSL into Nmap, the only purpose is to find bri> out what's listening on the port inside the SSL layer, and the bri> strength of the encryption is completely irrelevant. It'll seed bri> with totaly unrandom junk if it needs to, and the list of offered bri> ciphers is sorted by speed as measured on my 686, rather than by bri> cipher strength. Yes, of course, there are special conditions that allow sloppy randomness. If you look at some of the OpenSSL test programs, you will see that we seed with static strings. I was speaking from a more general point of view, and perhaps I should not have said something as harsch as "Never..." and should have said "If you have reasons to care about entropy and security, never...". The reasons I expressed it in so hard terms is that there has been some advice talking about static strings or output from commands that do not really provide that much entropy (I'd expect the entropy value on such files to be far less that 0.01), and that kind of advice has ended up in software that made serious security claims. *ahem* bri> But then again, I can't think of any other valid reasons for bri> doing things this way. It kinda hurt writing it, even though it bri> was correct for the purpose. No need to be hurt, and I appologise if I caused that. ----- Please consider sponsoring my work on free software. See http://www.free.lp.se/sponsoring.html for details. You don't have to be rich, a $10 donation is appreciated! -- Richard Levitte \ Tunnlandsv�gen 3 \ [EMAIL PROTECTED] [EMAIL PROTECTED] \ S-168 36 BROMMA \ T: +46-8-26 52 47 \ SWEDEN \ or +46-708-26 53 44 Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED] Member of the OpenSSL development team: http://www.openssl.org/ Unsolicited commercial email is subject to an archival fee of $400. See <http://www.stacken.kth.se/~levitte/mail/> for more info. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
