6 ms·

Is the lack of entropy really a bottleneck in a server?

• scdlbx 16y ago
  If the application running on the server needs to generate a lot of random numbers, yes.
  • JoachimSchipper 16y ago
    Only if they need to be cryptographically secure - a PRNG, occasionally seeded with "real" entropy, is sufficient for almost all uses.
• mey 16y ago
  High volume SSL/SSH traffic. Systems can be configured to fall back to insecure random number generator under load but it creates an attack vector where you intentionally DoS a system, then have more leverage to crack the encryption based on the weak(read predictable) random data the encryption is based on. The practicality of such an attack is beyond my knowledge.
• davidu 16y ago
  Yes, it can be. In addition to a security issue making timing attacks more practical if an attacker knows they can deplete the entropy pool in a repeatable fashion.