4 ms·

If I may ask a potentially silly question, does this have any security implications for RC4-based random number generators (notably, FreeBSD arc4random[1] and l

If I may ask a potentially silly question, does this have any security implications for RC4-based random number generators (notably, FreeBSD arc4random[1] and libbsd arc4random[2]; OpenBSD and NetBSD seem to have replaced their arc4random with a ChaCha-based RNG around 2013)? [1] https://svnweb.freebsd.org/base/release/10.1.0/lib/libc/gen/arc4random.c?revision=274417&view=markup https://svnweb.freebsd.org/base/release/10.1.0/lib/libc/gen/... [2] http://cgit.freedesktop.org/libbsd/tree/src/arc4random.c http://cgit.freedesktop.org/libbsd/tree/src/arc4random.c

tedunangst 11y ago
Yes and no. Practical exploitation depends on how the RNG is being used. The good news is that, as noted, replacement code is available for those who want it.