6 ms·
Yes, they both use the same PRNG construction, that's in the article I linked to. But the blocking behavior of /dev/random does give it information-theoretic s
by dietrichepp 11y ago
Yes, they both use the same PRNG construction, that's in the article I linked to. But the blocking behavior of /dev/random does give it information-theoretic security, because an attacker with unlimited computational power can't predict its output, assuming they don't know the outputs of the entropy sources you are using, assuming that your entropy estimates are accurate or conservative. And we use /dev/urandom because information-theoretic security in our RNG does not improve actual system security.
- Tomte 11y agoNo, it doesn't, because all the mixing and mangling of your precious entropy inside drivers/char/random.c is not information-theoretically secure.
- dietrichepp 11y agoRight, I give up. What I should have said is, "/dev/random is a misguided attempt at information-theoretic security." Everything in its design makes it clear that its goal is information-theoretic security. I was thinking, "Oh, the mixing is good enough for practical use." But that's not what information-theoretic means. I was thinking, "Oh, assuming the entropy estimation works." But we know it doesn't. It was a stupid argument. But then again, /dev/random is stupid. Nobody gives a damn about information-theoretic security, and we don't have it anyway.