3 ms·
Wow, so when would be the worst time to suspend your computer? The only time I imagine this, is when generating a private key for a production environment.
by throwayEngineer 7y ago
Wow, so when would be the worst time to suspend your computer?
The only time I imagine this, is when generating a private key for a production environment.
- deleted 7y ago[deleted]
- hedora 7y agoMy reading is that systemd uses the cryptographically secure rng to generate a unique id for a filename, and doesn't handle collisions properly. sigh
- floatboth 7y agoWell, not handling collisions helps a lot with exposing bad CSPRNGs. If they (and e.g. OpenSSH as mentioned in the original 2014 bug report) did handle collisions, it could've remained unnoticed.
- rwmj 7y agoThere shouldn't be collisions. I mean that really: if you see a collision it's so much more likely that your computer / program / source of randomness is faulty [as in this case] than that the two random numbers collided that it's not worth considering the collision case.
- lokedhs 7y agoBut there can be collisions, at least in theory. And as we can see, in practice too. Not checking for collisions because you trust that an RNG returns unique values is a fallacy and should be avoided. Especially since it's so easy to deal with the problem.
- codedokode 7y agoIt would be better to report the collision because most likely it means some error.
- lokedhs 7y agoYes, of course. As long as you do something. Just ignoring it because it's assumed it'll never happen is just bad design.