3 ms·
A PRNG debian bad? I remember the ssh keys incident years ago (that was indeed ridiculouts, but shit happens). But I don't remember any new facts about debian
by SFjulie1 11y ago
A PRNG debian bad?
I remember the ssh keys incident years ago (that was indeed ridiculouts, but shit happens).
But I don't remember any new facts about debian weakening PRNG since.
PS: Ok, I also missed debian infortunately also weakening the openSSL PRNG until 2008.
- cwmma 11y agoThe random data that was used to initalize the PRNG was removed as it was causing a linting error and only the PID was used meaning there were only 32768 (2^15) initial states that the PRNG would be seeded with. https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number...
- SFjulie1 11y agoYes I remembered this one, and this resulted in the SSH keys being weakened. So ... it is the same incident. OpenBSD could forgot one day. As if 50 core devs pretending to know their jobs could do better than 10000 devs with tremenduous amounts of guidelines and administrative rules and a fair amount of political commissars. Lol. Bureaucracy will always beat amateurs.
- kryptiskt 11y agoWeakened? It meant it would only generate a couple of thousand keys, that's not weakened, that means security was killed completely. And it was in there for a couple of years. All in all a total fiasco and legendary for very good reasons. Trying to paper over it and pretending it was no big deal is the best way to ensure that similar things will happen again.