The book "Network security with OpenSSL" says about seeding the OpenSSL
PRNG (on page 19):
"If you try to use OpenSSL without bothering to seed the random number
generator, the library will complain."
I recently discovered that I have been using DSA_generate_key() and
DSA_sign() without having seeded the OpenSSL PRNG. Nevertheless, I have
never noticed any complaint of the OpenSSL library.
This makes me think that:
- either there has been some other call into the OpenSSL library that
implicitly seeded the PRNG without my noticing it (perhaps
DSA_generate_parameters() or DSA_new() ), or
- the warning mechanism doesn't work properly
Can anybody shed some light on what's happening here?
In case it's relevant: the DSA_* functions that I mentioned above, are
used in a program that has been running on Linux and on Windows 2000.
Thanks in advance,
Erik Leunissen.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
