3 ms·
> userland RNGs are essentially the source of all practical CSPRNG vulnerabilities in the past 2 decades Is your point that CSPRNGs should not be implemented i
by rocqua 5y ago
> userland RNGs are essentially the source of all practical CSPRNG vulnerabilities in the past 2 decades
Is your point that CSPRNGs should not be implemented in userland, but instead should just read from /dev/random or do the equivalent on non-linux opperating systems?
- loeg 5y agoYes, that’s been Thomas’s position for many years[1]. And I mostly agree with him on that. [1]: https://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ https://sockpuppet.org/blog/2014/02/25/safely-generate-rando...