4 ms·
Only external TRNGs, or even ones built into SoCs or CPUs, like RDRAND? I think RDRAND is well worth the negligible cost of including it. It can give you entr
by comex 9y ago
Only external TRNGs, or even ones built into SoCs or CPUs, like RDRAND?
I think RDRAND is well worth the negligible cost of including it. It can give you entropy immediately, even during early boot (e.g. for ASLR); no need to wait or have any logic to deal with entropy not being ready yet (at least if you can rely on it being available, which should be true in the future). And compared to other approaches, it’s a lot harder to screw up or misuse, eliminating a whole class of potential vulnerabilities (especially if you use it directly rather than just seeding a kernel PRNG with it).
- tptacek 9y agoI'm not here to litigate how big a deal embedded cold start entropy problems are, so much as to point out that USB devices to increase "entropy" for consumer devices are silly and don't solve a real security problem, but do contribute to the misapprehension people have about the importance of "true randomness".