4 ms·
"hashing the output of a RNG is a bad countermeasure against a possibly-bad RNG" Why? I would think it's a fair suggestion for defense in depth, especially if
by jorangreef 9y ago
"hashing the output of a RNG is a bad countermeasure against a possibly-bad RNG"
Why? I would think it's a fair suggestion for defense in depth, especially if you need to expose the result as a nonce, and you don't want to leak anything else unwittingly. It's also a good idea if you're not sure whether the entropy is evenly distributed, which is where something like HKDF would also want to hash the entropy source.
"using protocols that don't require entropy"
That rules out most secure protocol handshakes.
- wbl 9y agoYou could just use a better RNG in the first place.
- jorangreef 9y agoThe point is that it's not XOR. You can use a better RNG and also hash entropy before exposing it as a nonce. Why throw out defense in depth?