3 ms·
Random number generation, including arc4random() and /dev/*random: OpenBSD: ChaCha20 FreeBSD: RC4 NetBSD: NIST CTR_DRBG using AES-128 HardenedBSD: ?
by Panino 8y ago
Random number generation, including arc4random() and /dev/*random:
OpenBSD: ChaCha20
FreeBSD: RC4
NetBSD: NIST CTR_DRBG using AES-128
HardenedBSD: ?
Dragonfly BSD: xor of outputs ChaCha20 and IBAA
Also on OpenBSD, major 3rd party packages often come with security improvements. For example, nginx and Apache run chrooted, and Chrome is pledged.
I don't have the time to analyze privsep in base among the BSDs, but I can say it's extensive in OpenBSD.
I would love to see pledge support in HardenedBSD. I think they're doing good work. Hopefully FreeBSD can import some of it.
Also, Dragonfly is a first-class BSD citizen and should be included in comparisons. As a recent example, the project leader, Matthew Dillon, has done excellent work relating to Speculative Execution and collaborated with other BSDs which helped everyone. Also I'm pretty sure OpenBSD has imported a number of hardware drivers from Dragonfly.
- textmode 8y agoThe table in the parent comment lacks versions. If I am not mistaken, NetBSD uses ChaCha20 since 2015. https://github.com/NetBSD/src/blob/trunk/lib/libc/gen/arc4random.c https://github.com/NetBSD/src/blob/trunk/lib/libc/gen/arc4ra...
- Panino 8y agoThank you for the correction! I only looked at NetBSD's random(4) manual page: http://netbsd.gw.com/cgi-bin/man-cgi?random+4+NetBSD-current http://netbsd.gw.com/cgi-bin/man-cgi?random+4+NetBSD-current So NetBSD uses AES-128 in /dev/*random and ChaCha20 in arc4random(). I wonder why?
- lattera 8y agoHardenedBSD currently follows upstream FreeBSD with regards to in-kernel crypto.
- floatboth 8y agoFreeBSD only uses arc4 for arc4random (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=182610 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=182610 -- chacha patch). Kernel random (read_random_uio(9) / sysctl kern.arandom / /dev/*random / getrandom(2) / getentropy(3)) has been Fortuna since v10, and Yarrow before that.