4 ms·
I don't think this is to shake out bugs. This is just to have a more random pseudo-random number generator so that applications using the crypto package for enc
by omarforgotpwd 8y ago
I don't think this is to shake out bugs. This is just to have a more random pseudo-random number generator so that applications using the crypto package for encryption will be more secure.
- staticassertion 8y agoWhy would it do it randomly then? Just read in the extra byte if you want extra entropy.
- rsc 8y agoStarting at the link above, click on the #21915 in the commit message, which takes you to https://golang.org/issue/21915 https://golang.org/issue/21915.
- staticassertion 8y agoSo for no reason, it is about forcing code not to rely on the behavior.
- baq 8y agoThere's a reason given.
- staticassertion 8y agoAs in, the reason has nothing to do with entropy, and it is just about breaking code relying on an unspecified behavior.
- omarforgotpwd 8y agoOne really easy way to break any encryption scheme is to crack the random number generator. This works because random number generators are deterministic and you can get them to output the exact same stream of random numbers as they did before if you have the same seed / state. This is presumably about making the output of the random number generator harder to predict.
- staticassertion 8y ago> This is presumably about making the output of the random number generator harder to predict. Randomly deciding to add an extra byte of entropy only adds 1 bit of entropy. Adding the extra byte always adds 8 bits of entropy. There is no cryptographic reason to do this. It is just to break assumptions about the API.