4 ms·
tldr; just use /dev/urandom --- this should be at the top of the page. Maybe prefix the bold sections with Myth: so it is easier to read. I was really confused
by kbaker 10y ago
tldr; just use /dev/urandom --- this should be at the top of the page.
Maybe prefix the bold sections with Myth: so it is easier to read. I was really confused as to which side of the argument the author was on at first...
- citrin_ru 10y agoOr better use getentropy(2)/getrandom(2) when it is possible.
- JoshTriplett 10y agoTrue, but never pass GRND_RANDOM or GRND_NONBLOCK.
- zrm 10y agoWhy do these flags exist if they should never be used?
- marcosdumay 10y agoThere are probably good uses for them. But unless you are doing something very tightly integrated with Linux, you should just ignore them.
- Gaelan 10y agoNONBLOCK just returns an error code instead of blocking. No harm in that, AFIAK.
- marcosdumay 10y agoJust wait until people start using the EAGAIN value in keys.
- eddieh 10y agoarc4random and arc4random_buf are probably better still.
- nshepperd 10y agoPlease don't use arc4random* for cryptographic purposes. RC4 is broken -- there are practical attacks against it. It's fine for non-secure purposes though (eg. monte carlo simulation).
- tossedaway334 10y agoarc4random uses chacha20 on openBSD now, has for several years, OSX and FreeBSD are yet to update...
- eddieh 10y agoThe macOS Sierra man page says it uses the NIST-approved AES cipher and will be replaced as the techniques advance.
- eddieh 10y agoThe 'arc4' no longer refers to RC4 on macOS/iOS and OpenBSD. On those systems 'arc4random' is playfully a bacronym for "A Replacement Call for Random". The new arc4random* implementation will now be replaced as cryptographic techniques advance. It appears the Apple and OpenBSD implementations use the getentropy syscall and then add additional entropy mixing.
- gbrown_ 10y agoYup, OpenBSD have even changed calls to other entropy sources to returning strong random by default from arc4random. http://marc.info/?l=openbsd-cvs&m=141807513728073&w=2 http://marc.info/?l=openbsd-cvs&m=141807513728073&w=2
- arthur2e5 10y agolibbsd is also using getentropy: https://cgit.freedesktop.org/libbsd/tree/src/arc4random.c https://cgit.freedesktop.org/libbsd/tree/src/arc4random.c
- rconti 10y agoI, too, found it INCREDIBLY difficult to read. Perhaps because I don't have much understanding of random-number generators, but I had to re-read the first handful of entries about 3 times before I could catch on. I think a big part of it was my tendency to read the BOLD statements as the facts. Then when it said FACT beneath it, I had to start all over again.