8 ms·

Librandombytes – a public domain library for generating randomness

82 points by tkhattra 4y ago

remram 4y ago
Is there an actual license file somewhere? Not only is the title of the page not necessarily authoritative enough, but public-domain dedication is not a thing in many countries, which is why CC-0 exists.
- tptacek 4y ago
  This is a whole can of worms with Bernstein. But the library is pretty trivial, so if this really worries you, just use `getrandom`. The actual source files are all labeled "public domain". That's all you're going to get from him.
- LarryMullins 4y ago
  > but public-domain dedication is not a thing in many countries, which is why CC-0 exists. Has there ever been a real instance of this distinction actually mattering? Has a German software company ever gotten into real trouble because they used American public domain code without a locally valid license? It seems like an academic objection for lawyers to wring their hands about. Risk adverse organizations with investors will demand licenses for software like SQLite because a few thousand dollars to eliminate a minuscule remote risk is basically nothing to a software business. But does your average German FOSS hacker bother to buy a license to SQLite? Would that really be a rational use of their own money? I doubt it.
  - remram 4y ago
    On some level, no open-source license matters, you are not going to get in trouble for stealing some rando's GitHub repository. In fact they would never find out. However if this aspect is important enough to you that you put it in the very title of your site, you should probably do it in a way that actually works for people.
    - LarryMullins 4y ago
      > However if this aspect is important enough to you that you put it in the very title of your site, you should probably do it in a way that actually works for people. I assert that public domain does work for people, even Germans in practice. It doesn't work for risk averse corporations.
      - remram 4y ago
        The point of a license is entirely to mitigate risk. I trust open-source developers to not go after me and my meager projects, but still I appreciate when they take the 2min needed to slap a legal-like document on their library. When you refuse to do that, and decide to spend way more than 2min explaining your belief that this might not be required (though you are not a lawyer, have no court decisions to back it up, and have otherwise done a limited review of a few countries), you are making the conscious decision to go out of your way to increase the risk on me. I don't appreciate that, but does that really make me "risk-averse"?
        LarryMullins 4y ago
        American FOSS developers who put their code in the public domain are taking those 2 minutes to slap a legal-like document on their code. A short document telling other programmers that the code is public domain clearly communicates the intent and wishes of the author to other developers. They're giving something to the world for free, with no strings attached, clearly communicated. But despite that, some people will complain because it wasn't done in precisely the correct way to keep corporate lawyers in a notoriously legalistic and pedantic foreign country happy.
        dragonwriter 4y ago
        Any legal-like document that mitigates risk for one parry does so by restricting another party. So, its natural that people will choose not to do more of than they see as necessary to deal with speculative risks raised by third-parties who are often either not attorneys, or attorneys for people whose interests are not aligned with those whose action is sought, based on some foreign legal system with which thr actor is unfamiliar. If you don't like what you are being offered for free, you are, of course, at liberty to move along.
  - deleted 4y ago
    [deleted]
  - adamgordonbell 4y ago
    Not sure. But I think SQLite won't look at contributions from non-public domain countries. I mean, they aren't really open to contributions anyhow, but being public domain was mentioned to me by Richard as a mistake they made that they've had to deal with.
    - LarryMullins 4y ago
      > being public domain was mentioned to me by Richard as a mistake they made that they've had to deal with This doesn't sound right. Did he explain to you why he thinks he's stuck with it? He has the legal right to release SQLite other some other license and does so when companies pay him for it. Generally speaking, nothing about putting code in the public domain precludes collaborating with other developers. SQLite's caution against accepting contributions (even when the contributor is another American willing to sign over their contribution to the public domain) probably has more to do with Oracle being notoriously litigious and nasty. Not accepting contributions reduces the risk of one day being sued by Oracle, since it reduces the risk that Oracle IP might accidentally show up in SQLite. This would be a concern regardless of what sort of license SQLite used. If you're not worried about that sort of thing, there is nothing which prevents an American FOSS developer from accepting public domain contributions from other developers.
      - adamgordonbell 4y ago
        Going from memory, he was warned by legal or something, that someone from a place where public domain didn't exist as a concept couldn't give them code and say it was public domain. He's on here occasionally, so maybe he'll jump in but I think the issue is the contributors might not be able to put things into the public domain.
  - cryptonector 4y ago
    SQLite3 is in every phone and every laptop and... Do Apple, Google, etc. have to do something special in order to use SQLite3 in Germany? Have there been any court cases about this? Have there been any fines issued or paid over this? IMO the whole Germany-doesn't-have-public-domain thing is just FUD.
    - LarryMullins 4y ago
      SQLite offers to sell licenses to organizations that worry about it, Apple and Google have probably bought such licenses to cover their asses in Germany just in case.
      - cryptonector 4y ago
        Yeah, but does anyone really bother? Is there any German case law about this?
        GoblinSlayer 4y ago
        Germany uses civil law (Roman system), not common law.
        cryptonector 4y ago
        The courts might not make common law, but there could still be no court cases at all about public domain software, which would be pretty telling that those just don't come up even though there's an abundance of public domain source code.
    - remram 4y ago
      That is true, still it has a comprehensive copyright page which includes this rather explicit permission: > Anyone is free to copy, modify, publish, use, compile, sell, or distribute the original SQLite code, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means. https://www.sqlite.org/copyright.html https://www.sqlite.org/copyright.html This is quite different from librandombytes...
  - GoblinSlayer 4y ago
    Usually copyright is the author's right and only the author can enforce that right, so it would take the public domain author to sue users, which I suppose rarely happens.
- orlp 4y ago
  https://cr.yp.to/publicdomain.html https://cr.yp.to/publicdomain.html I'm not taking a stance, I'm just the messenger.
  - remram 4y ago
    Interesting. It is on purpose then, for equal or worse. Maybe he's right, maybe he's wrong. What he's not is a judge or lawyer, so I'll keep with the status quo of licensing.
    - loeg 4y ago
      What he isn't is a German. He's an American and the public domain is healthy and well established here.
      - madars 4y ago
        djb is also a German citizen https://cr.yp.to/cv/cv-20080915.pdf https://cr.yp.to/cv/cv-20080915.pdf (Citizenships: USA; Germany; Native language: English. Language courses: French (advanced), German, Danish.)
      - deleted 4y ago
        [deleted]
- loeg 4y ago
  > public-domain dedication is not a thing in many countries See the author's other page with thoughts on this subject: http://cr.yp.to/publicdomain.html http://cr.yp.to/publicdomain.html
- 1vuio0pswjnm7 4y ago
  Wow, is this really going to be the top comment. This library has been around since 2008 and chances are you are using software that includes it right now, e.g., if your web browser used djb-derived cryptography included in your browser when connecting to HN. If I wrote software using djb code and made money from it, and djb asked me for a percentage, then I would happily pay. The chances of that happening are probably nil, particularly the first part. Alternatively, if I wrote software using djb code and he asked me to refrain from doing something, then I would probably comply. He has a strong reputation for being right. Again, the chances of being asked for anything seem to be nil anyway. Assuming devurandom.c, i.e., randombytes(), is used in djb-authored cryptography, which itself or close derivatives are now used widely, how many of the folks working on the projects listed at the web pages below are using public domain djb code without a license (I don't know the answer, I'm asking a question). One might guess by looking at these lists that the "status quo" is to accept djb's public domain designation. https://ianix.com/pub/curve25519-deployment.html https://ianix.com/pub/curve25519-deployment.html https://ianix.com/pub/ed25519-deployment.html https://ianix.com/pub/ed25519-deployment.html https://ianix.com/pub/salsa20-deployment.html https://ianix.com/pub/salsa20-deployment.html https://ianix.com/pub/chacha-deployment.html https://ianix.com/pub/chacha-deployment.html Take OpenSSH for example. https://raw.githubusercontent.com/openssh/openssh-portable/master/crypto_api.h https://raw.githubusercontent.com/openssh/openssh-portable/m... OpenSSH uses djb cryptography for generating ed25519 keys, among other things. That uses randombytes() as in crypto_api.h above. djb's randombytes() is simply a wrapper around /dev/urandom, OpenSSH's randombytes() in ed25519.c is a wrapper around arc4random_buf(). arcrandom_buf() is a wrapper around arc4random(). arc4random() uses djb cryptography placed in the public domain. https://raw.githubusercontent.com/openssh/openssh-portable/master/openbsd-compat/chacha_private.h https://raw.githubusercontent.com/openssh/openssh-portable/m... No idea what software the parent writes but as an end user I would prefer to avoid it since apparently they have to avoid widely used, publicly vetted code because it's in the public domain.
  - remram 4y ago
    If you don't care whether it's public domain, that's fine. That seems completely orthogonal to the discussion of whether that works, though.
- deleted 4y ago
  [deleted]
jcrites 4y ago
Are there any methods of generating randomness on common platforms — Linux (raw or VM), Windows, MacOS — that are suitable for use as a cryptographic one-time pad? The definition of this library function seems to suggest that it’s suitable: > librandombytes aims for the following stringent randomness goal: no feasible computation will ever be able to tell the difference between the output bytes and true randomness (independent uniformly distributed random bytes). However my understanding is that PRNGs are not a suitable source of randomness for one time pads; that this would reduce OTP encryption to being something like an ad hoc stream cipher. So some implementations that might look random wouldn’t actually provide a suitable bitstream for this purpose: the bits in the output would be correlated, if in a complex, cryptographically obscure way. (But bits in a one-find pad should all be entirely random and uncorrelated.) Is that accurate? Do modern PCs have an efficient way to produce meaningful amounts of true stochastic random data suitable for use with OTP encryption (such as the RDRAND instruction)? What are some good abstractions for producing a stream of random data suitable for use with OTP cryptography? Edit: this is a question for the sake of curiosity. I realize that practical systems have many threat vectors and that OTP is not a panacea, or even necessarily an improvement.
- tptacek 4y ago
  "OTP cryptography" is for the most part not a thing. If you were running a spy ring and literally giving each of your agents a paper pad with numbers on them, you could print them from `getrandom` output; the `getrandom` bytes wouldn't be how that system was attacked.
  - e12e 4y ago
    Iirc NATO used a one time pad codebook for ship communication - but I suspect these days it would only be a fallback in case there's a need to use open radio or similar for signaling?
  - jcrites 4y ago
    This is an intellectual question for curiosity’s sake. I realize that an OTP encryption system will not be a practical improvement for communication compared to e.g. the Signal protocol, which is easier to use and provides a number of other advantageous properties; or something like TLS. (If you could securely exchange one time pad material, then you could also more easily exchange asymmetric keys) I realize that actual systems have a large number of threat vectors, and that the encryption protocol itself is unlikely to be the primary risk. Nevertheless, I’m curious: if one decides to implement digital encryption using one time pads, what is the most practical source of suitable randomness? And have communication protocols been designed for OTP, or would your best bet be to layer it on top of something like Signal or TLS? It seems that you probably need to exchange at least some metadata along with each message describing, e.g., the message size and starting offset into the pad material - metadata that you’d want to protect with encryption, and I don’t see a very straightforward way to protect it using OTP. On reflection, this probably only has relevance for government or military communications that might need to remain secure for longer than 50 years. Perhaps the use-case is something like an aircraft carrier, submarine, or other large, critical vehicle or facility, that receives OTP material by delivery of a hard drive protected by considerable physical security. Critical communication from these vehicles/infrastructure would remain protected against future cryptographic attacks - e.g., if an algorithmic vulnerability is discovered, or there’s a breakthrough in quantum or traditional computing that renders today’s encryption vulnerable within the next few decades — the OTP-protected message content remains protected. (Even if intercepted, recorded, and attacked decades later) Yes, I agree that the practical applications are limited… The questions are an exercise for curiosity’s sake: if you’re going to employ OTP encryption, then …
benj111 4y ago
When are we going to get a distributed peer to peer randomness service. I could roll a die in return for $random crypto currency. Obviously the amount could vary depending on the amount of randomness. So me thinking of a random number would get less than a die roll which would get less than this comment.
- beardog 4y ago
  If your values don't need to be secret, you can use the latest bitcoin header.[1] Similar to centralized random beacons like the NIST[2] and Chile beacons. 1: https://eprint.iacr.org/2015/1015.pdf https://eprint.iacr.org/2015/1015.pdf 2: https://csrc.nist.gov/projects/interoperable-randomness-beacons https://csrc.nist.gov/projects/interoperable-randomness-beac...
  - treis 4y ago
    Why would one need randomness that isn't secret?
    - beardog 4y ago
      Verifiable lotteries and time stamping are the use cases I am aware of.
- Nalta 4y ago
  that sounds like a great idea! I'll return 3 when peers ask me for a random number, and then I'll start seeing if that seed shows us in any prominent RSA private keys
  - benj111 4y ago
    As long as the 3 was randomly derived that's fine.
- dspillett 4y ago
  > When are we going to get a distributed peer to peer randomness service. (assuming you mean computers returning random numbers, and your people with dice is an analogy) The problem with that is how do you trust the source if you need “cryptographically secret” random numbers. One of the sources could poison the well with bad entropy and increase by a small but significant amount the chance of guessing your keys. OK, so you could the data from many sources, but that would add latency so not an option where performance matters and even then if someone gains control of a significant portion of the distributed system (just by standing up lots of hosts) the issue persists. You could also do a bunch of statistical tests, but again that is work that will harm performance and if you are going to that sort of effort anyway you could setup your own random sources (a couple of active Linux boxes, on older Linux kernels running haveged, on newer ones the latter part isn't needed (https://github.com/jirka-h/haveged/issues/57 https://github.com/jirka-h/haveged/issues/57)) and use those tests to make sure those sources are statically safe. So such a service isn't really needed, and where it might be isn't likely to be trusted, so it could exist but as a play-thing not a serious service. On my little home server, not a particularly up to date CPU etc, running 5.10, I can pull >3Gbit/sec from /dev/random. Heck, the Pi400 that is currently my router can hand out ~230Mbit/sec or entropy.
throwaway81523 4y ago
This is a randomness distillation function that gets entropy from a system source like linux getrandom() or the OpenSSL RNG. It's nice but it is purely computational. It doesn't harvest entropy on its own, if that is what you were hoping.
- lxgr 4y ago
  > It doesn't harvest entropy on its own, if that is what you were hoping. I'm actually hoping that userspace applications stop attempting any such thing if it can be at all avoided (and on most systems, it can).
- ilyt 4y ago
  Why it would need to "distill" anything on modern Linux/BSD?
  - throwaway81523 4y ago
    I think the idea is to be fast by avoiding system calls and using fast primitives underneath, and to unreversibly garble the internal state quickly. I don't see very obvious applications for this though. If you think your computer is leaking internal state, you have bigger problems. Otherwise, use getrandom() to seed your favorite stream cipher. I do want to look at this more closely, because if DJB thinks it is worthwhile, there is likely to be something to it. But it doesn't jump out at me after the quick glance that I took.
    - ilyt 4y ago
      Well the lib is from 2008 where randomness story looked worse. Might be worthwhile back then. Also > Another virtue of having a randombytes() abstraction layer is that test frameworks can substitute a deterministic seeded randombytes() providing known pseudorandom bytes for reproducible tests. Of course, the randombytes() provided by these test frameworks must be kept separate from the fresh randombytes() used for deployment.
olliej 4y ago
arc4random() has existed to produce cryptographically random values for well over a decade (and despite the name, on Mac at least is not rc4 based and I assume Linux is the same). Additionally windows and Darwin/xnu have API to get large arrays of random values and I again will just assume Linux does too. This library should not be doing anything other than wrapping the specific api provided by the host platform.
1vuio0pswjnm7 4y ago
Small program to generate random bytes to stdout, using original 2008 randombytes() function that presumably inspired librandombytes. Usage: a.out number_of_bytes For example, a.out 128 > data od -tx1 -An < data Taken from public domain source code by djb and jmojzis. Tested on Void Linux with musl. #include <stdlib.h> #include <unistd.h> #include <sys/types.h> #include <fcntl.h> #include <poll.h> #include <errno.h> #include <sys/stat.h> int strtonum(long long *,const char *); int strtonum(long long *r,const char *buf){ char *bufpos=(char *)buf; int flagsign=0; long long i; unsigned long long c,ret=0; if (!buf) goto failed; switch(buf[0]){ case 0: goto failed;break; case '+': ++bufpos;break; case '-': flagsign=1;++bufpos;break; default: break; } for(i=0;bufpos[i];++i){ c=bufpos[i]-'0'; if(c<0||c>9)break; c+=10*(ret); if(ret>c)goto failed; ret=c; } if(i==0)goto failed; if(flagsign){*r=-ret;if(*r>0)goto failed;} else{*r=ret;if(*r<0)goto failed;} return 1; failed: *r=0; errno=EINVAL; return 0; } int writeall(int,const void *,long long); int writeall(int fd,const void *xv,long long xlen) { const unsigned char *x=xv; long long w; while(xlen>0){ w=xlen; if(w>1048576)w=1048576; w=write(fd,x,w); if(w<0){ if(errno==EINTR||errno==EAGAIN||errno==EWOULDBLOCK){ struct pollfd p;p.fd=fd;p.events=POLLOUT|POLLERR; poll(&p,1,-1);continue; } return -1; } x += w; xlen -= w; } return 0; } void randombytes(unsigned char *,unsigned long long); /* it's really stupid that there isn't a syscall for this */ static int fd = -1; void randombytes(unsigned char *x,unsigned long long xlen) { int i; if(fd==-1){ for(;;){ fd=open("/dev/urandom",O_RDONLY); if(fd!=-1)break; sleep(1); } } while(xlen>0){ if(xlen<1048576)i=xlen;else i=1048576; i=read(fd,x,i); if(i<1){sleep(1);continue;} x+=i;xlen-=i; } } int fsyncfd(int); int fsyncfd(int fd){ struct stat st; if(fstat(fd,&st)==0&&S_ISREG(st.st_mode)){ if(fsync(fd)==-1)return -1;} return 0; } void byte_zero(void *,long long); void byte_zero(void *yv,long long ylen){ long long i;char *y=yv; for(i=0;i<ylen;++i)y[i]=0; } static unsigned char buf[4096]; int main(int argc,char **argv){ long long i,l; if(!strtonum(&l,argv[1])||l<0)exit(0); byte_zero(buf,sizeof buf); while(l>0){ i=l; if(i>sizeof buf)i=sizeof buf; randombytes(buf,i); if(writeall(1,buf,i)==-1)exit(0); l-=i; } if(fsyncfd(1)==-1)exit(0); exit(0); }
josephg 4y ago
How does this compare to what you get from one of the csprngs in rust's rand crate? I'm not sure when I'd use this. https://rust-random.github.io/book/guide-rngs.html#cryptographically-secure-pseudo-random-number-generators-csprngs https://rust-random.github.io/book/guide-rngs.html#cryptogra...
- greenicon 4y ago
  There shouldn’t be much of a difference, although the rust crate is more similar to the OpenSSL part. Just make sure to properly seed your CSPRNG, e.g. via using Rust’s ThreadRng[1]. In basically all cases there is no reason to use anything from the rand crate except ThreadRng. 1: https://rust-random.github.io/rand/rand/rngs/struct.ThreadRng.html https://rust-random.github.io/rand/rand/rngs/struct.ThreadRn...
  - tptacek 4y ago
    If you have to seed it, you're doing something wrong. You want to be using the system random number generator, the one the kernel provides, in preference to any userland RNG.
    - josephg 4y ago
      ThreadRng is what the GP recommended. From the linked page: > ThreadRng is automatically seeded from OsRng with periodic reseeding (every 64 kiB, as well as “soon” after a fork on Unix — see ReseedingRng documentation for details). Is the system's random number generator actually better than this? It looks like the rand developers know what they're doing, and using a library like this is attractive because I don't have to figure out the "right" random number API on different operating systems. (arc4random()? Is that only a macos thing? srandom()? random()? What is it on windows? Should I be reading from /dev/srandom or something? Etc.)
dogeprotocol 4y ago
Can anyone recommend between Librandombytes and libsodium ramdombytes? https://github.com/jedisct1/libsodium/tree/master/src/libsodium/randombytes https://github.com/jedisct1/libsodium/tree/master/src/libsod...
- tptacek 4y ago
  If you're using libsodium, use libsodium's randombytes.

82 points by tkhattra 4y ago

Is there an actual license file somewhere? Not only is the title of the page not necessarily authoritative enough, but public-domain dedication is not a thing in many countries, which is why CC-0 exists.

tptacek 4y ago
This is a whole can of worms with Bernstein. But the library is pretty trivial, so if this really worries you, just use `getrandom`. The actual source files are all labeled "public domain". That's all you're going to get from him.
LarryMullins 4y ago
> but public-domain dedication is not a thing in many countries, which is why CC-0 exists. Has there ever been a real instance of this distinction actually mattering? Has a German software company ever gotten into real trouble because they used American public domain code without a locally valid license? It seems like an academic objection for lawyers to wring their hands about. Risk adverse organizations with investors will demand licenses for software like SQLite because a few thousand dollars to eliminate a minuscule remote risk is basically nothing to a software business. But does your average German FOSS hacker bother to buy a license to SQLite? Would that really be a rational use of their own money? I doubt it.
- remram 4y ago
  On some level, no open-source license matters, you are not going to get in trouble for stealing some rando's GitHub repository. In fact they would never find out. However if this aspect is important enough to you that you put it in the very title of your site, you should probably do it in a way that actually works for people.
  - LarryMullins 4y ago
    > However if this aspect is important enough to you that you put it in the very title of your site, you should probably do it in a way that actually works for people. I assert that public domain does work for people, even Germans in practice. It doesn't work for risk averse corporations.
    - remram 4y ago
      The point of a license is entirely to mitigate risk. I trust open-source developers to not go after me and my meager projects, but still I appreciate when they take the 2min needed to slap a legal-like document on their library. When you refuse to do that, and decide to spend way more than 2min explaining your belief that this might not be required (though you are not a lawyer, have no court decisions to back it up, and have otherwise done a limited review of a few countries), you are making the conscious decision to go out of your way to increase the risk on me. I don't appreciate that, but does that really make me "risk-averse"?
      - LarryMullins 4y ago
        American FOSS developers who put their code in the public domain are taking those 2 minutes to slap a legal-like document on their code. A short document telling other programmers that the code is public domain clearly communicates the intent and wishes of the author to other developers. They're giving something to the world for free, with no strings attached, clearly communicated. But despite that, some people will complain because it wasn't done in precisely the correct way to keep corporate lawyers in a notoriously legalistic and pedantic foreign country happy.
      - dragonwriter 4y ago
        Any legal-like document that mitigates risk for one parry does so by restricting another party. So, its natural that people will choose not to do more of than they see as necessary to deal with speculative risks raised by third-parties who are often either not attorneys, or attorneys for people whose interests are not aligned with those whose action is sought, based on some foreign legal system with which thr actor is unfamiliar. If you don't like what you are being offered for free, you are, of course, at liberty to move along.
- deleted 4y ago
  [deleted]
- adamgordonbell 4y ago
  Not sure. But I think SQLite won't look at contributions from non-public domain countries. I mean, they aren't really open to contributions anyhow, but being public domain was mentioned to me by Richard as a mistake they made that they've had to deal with.
  - LarryMullins 4y ago
    > being public domain was mentioned to me by Richard as a mistake they made that they've had to deal with This doesn't sound right. Did he explain to you why he thinks he's stuck with it? He has the legal right to release SQLite other some other license and does so when companies pay him for it. Generally speaking, nothing about putting code in the public domain precludes collaborating with other developers. SQLite's caution against accepting contributions (even when the contributor is another American willing to sign over their contribution to the public domain) probably has more to do with Oracle being notoriously litigious and nasty. Not accepting contributions reduces the risk of one day being sued by Oracle, since it reduces the risk that Oracle IP might accidentally show up in SQLite. This would be a concern regardless of what sort of license SQLite used. If you're not worried about that sort of thing, there is nothing which prevents an American FOSS developer from accepting public domain contributions from other developers.
    - adamgordonbell 4y ago
      Going from memory, he was warned by legal or something, that someone from a place where public domain didn't exist as a concept couldn't give them code and say it was public domain. He's on here occasionally, so maybe he'll jump in but I think the issue is the contributors might not be able to put things into the public domain.
- cryptonector 4y ago
  SQLite3 is in every phone and every laptop and... Do Apple, Google, etc. have to do something special in order to use SQLite3 in Germany? Have there been any court cases about this? Have there been any fines issued or paid over this? IMO the whole Germany-doesn't-have-public-domain thing is just FUD.
  - LarryMullins 4y ago
    SQLite offers to sell licenses to organizations that worry about it, Apple and Google have probably bought such licenses to cover their asses in Germany just in case.
    - cryptonector 4y ago
      Yeah, but does anyone really bother? Is there any German case law about this?
      - GoblinSlayer 4y ago
        Germany uses civil law (Roman system), not common law.
        cryptonector 4y ago
        The courts might not make common law, but there could still be no court cases at all about public domain software, which would be pretty telling that those just don't come up even though there's an abundance of public domain source code.
  - remram 4y ago
    That is true, still it has a comprehensive copyright page which includes this rather explicit permission: > Anyone is free to copy, modify, publish, use, compile, sell, or distribute the original SQLite code, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means. https://www.sqlite.org/copyright.html https://www.sqlite.org/copyright.html This is quite different from librandombytes...
- GoblinSlayer 4y ago
  Usually copyright is the author's right and only the author can enforce that right, so it would take the public domain author to sue users, which I suppose rarely happens.
orlp 4y ago
https://cr.yp.to/publicdomain.html https://cr.yp.to/publicdomain.html I'm not taking a stance, I'm just the messenger.
- remram 4y ago
  Interesting. It is on purpose then, for equal or worse. Maybe he's right, maybe he's wrong. What he's not is a judge or lawyer, so I'll keep with the status quo of licensing.
  - loeg 4y ago
    What he isn't is a German. He's an American and the public domain is healthy and well established here.
    - madars 4y ago
      djb is also a German citizen https://cr.yp.to/cv/cv-20080915.pdf https://cr.yp.to/cv/cv-20080915.pdf (Citizenships: USA; Germany; Native language: English. Language courses: French (advanced), German, Danish.)
    - deleted 4y ago
      [deleted]
loeg 4y ago
> public-domain dedication is not a thing in many countries See the author's other page with thoughts on this subject: http://cr.yp.to/publicdomain.html http://cr.yp.to/publicdomain.html
1vuio0pswjnm7 4y ago
Wow, is this really going to be the top comment. This library has been around since 2008 and chances are you are using software that includes it right now, e.g., if your web browser used djb-derived cryptography included in your browser when connecting to HN. If I wrote software using djb code and made money from it, and djb asked me for a percentage, then I would happily pay. The chances of that happening are probably nil, particularly the first part. Alternatively, if I wrote software using djb code and he asked me to refrain from doing something, then I would probably comply. He has a strong reputation for being right. Again, the chances of being asked for anything seem to be nil anyway. Assuming devurandom.c, i.e., randombytes(), is used in djb-authored cryptography, which itself or close derivatives are now used widely, how many of the folks working on the projects listed at the web pages below are using public domain djb code without a license (I don't know the answer, I'm asking a question). One might guess by looking at these lists that the "status quo" is to accept djb's public domain designation. https://ianix.com/pub/curve25519-deployment.html https://ianix.com/pub/curve25519-deployment.html https://ianix.com/pub/ed25519-deployment.html https://ianix.com/pub/ed25519-deployment.html https://ianix.com/pub/salsa20-deployment.html https://ianix.com/pub/salsa20-deployment.html https://ianix.com/pub/chacha-deployment.html https://ianix.com/pub/chacha-deployment.html Take OpenSSH for example. https://raw.githubusercontent.com/openssh/openssh-portable/master/crypto_api.h https://raw.githubusercontent.com/openssh/openssh-portable/m... OpenSSH uses djb cryptography for generating ed25519 keys, among other things. That uses randombytes() as in crypto_api.h above. djb's randombytes() is simply a wrapper around /dev/urandom, OpenSSH's randombytes() in ed25519.c is a wrapper around arc4random_buf(). arcrandom_buf() is a wrapper around arc4random(). arc4random() uses djb cryptography placed in the public domain. https://raw.githubusercontent.com/openssh/openssh-portable/master/openbsd-compat/chacha_private.h https://raw.githubusercontent.com/openssh/openssh-portable/m... No idea what software the parent writes but as an end user I would prefer to avoid it since apparently they have to avoid widely used, publicly vetted code because it's in the public domain.
- remram 4y ago
  If you don't care whether it's public domain, that's fine. That seems completely orthogonal to the discussion of whether that works, though.
deleted 4y ago
[deleted]

jcrites 4y ago

Are there any methods of generating randomness on common platforms — Linux (raw or VM), Windows, MacOS — that are suitable for use as a cryptographic one-time pad? The definition of this library function seems to suggest that it’s suitable: > librandombytes aims for the following stringent randomness goal: no feasible computation will ever be able to tell the difference between the output bytes and true randomness (independent uniformly distributed random bytes). However my understanding is that PRNGs are not a suitable source of randomness for one time pads; that this would reduce OTP encryption to being something like an ad hoc stream cipher. So some implementations that might look random wouldn’t actually provide a suitable bitstream for this purpose: the bits in the output would be correlated, if in a complex, cryptographically obscure way. (But bits in a one-find pad should all be entirely random and uncorrelated.) Is that accurate? Do modern PCs have an efficient way to produce meaningful amounts of true stochastic random data suitable for use with OTP encryption (such as the RDRAND instruction)? What are some good abstractions for producing a stream of random data suitable for use with OTP cryptography? Edit: this is a question for the sake of curiosity. I realize that practical systems have many threat vectors and that OTP is not a panacea, or even necessarily an improvement.

tptacek 4y ago
"OTP cryptography" is for the most part not a thing. If you were running a spy ring and literally giving each of your agents a paper pad with numbers on them, you could print them from `getrandom` output; the `getrandom` bytes wouldn't be how that system was attacked.
- e12e 4y ago
  Iirc NATO used a one time pad codebook for ship communication - but I suspect these days it would only be a fallback in case there's a need to use open radio or similar for signaling?
- jcrites 4y ago
  This is an intellectual question for curiosity’s sake. I realize that an OTP encryption system will not be a practical improvement for communication compared to e.g. the Signal protocol, which is easier to use and provides a number of other advantageous properties; or something like TLS. (If you could securely exchange one time pad material, then you could also more easily exchange asymmetric keys) I realize that actual systems have a large number of threat vectors, and that the encryption protocol itself is unlikely to be the primary risk. Nevertheless, I’m curious: if one decides to implement digital encryption using one time pads, what is the most practical source of suitable randomness? And have communication protocols been designed for OTP, or would your best bet be to layer it on top of something like Signal or TLS? It seems that you probably need to exchange at least some metadata along with each message describing, e.g., the message size and starting offset into the pad material - metadata that you’d want to protect with encryption, and I don’t see a very straightforward way to protect it using OTP. On reflection, this probably only has relevance for government or military communications that might need to remain secure for longer than 50 years. Perhaps the use-case is something like an aircraft carrier, submarine, or other large, critical vehicle or facility, that receives OTP material by delivery of a hard drive protected by considerable physical security. Critical communication from these vehicles/infrastructure would remain protected against future cryptographic attacks - e.g., if an algorithmic vulnerability is discovered, or there’s a breakthrough in quantum or traditional computing that renders today’s encryption vulnerable within the next few decades — the OTP-protected message content remains protected. (Even if intercepted, recorded, and attacked decades later) Yes, I agree that the practical applications are limited… The questions are an exercise for curiosity’s sake: if you’re going to employ OTP encryption, then …

benj111 4y ago

When are we going to get a distributed peer to peer randomness service. I could roll a die in return for $random crypto currency. Obviously the amount could vary depending on the amount of randomness. So me thinking of a random number would get less than a die roll which would get less than this comment.

beardog 4y ago
If your values don't need to be secret, you can use the latest bitcoin header.[1] Similar to centralized random beacons like the NIST[2] and Chile beacons. 1: https://eprint.iacr.org/2015/1015.pdf https://eprint.iacr.org/2015/1015.pdf 2: https://csrc.nist.gov/projects/interoperable-randomness-beacons https://csrc.nist.gov/projects/interoperable-randomness-beac...
- treis 4y ago
  Why would one need randomness that isn't secret?
  - beardog 4y ago
    Verifiable lotteries and time stamping are the use cases I am aware of.
Nalta 4y ago
that sounds like a great idea! I'll return 3 when peers ask me for a random number, and then I'll start seeing if that seed shows us in any prominent RSA private keys
- benj111 4y ago
  As long as the 3 was randomly derived that's fine.
dspillett 4y ago
> When are we going to get a distributed peer to peer randomness service. (assuming you mean computers returning random numbers, and your people with dice is an analogy) The problem with that is how do you trust the source if you need “cryptographically secret” random numbers. One of the sources could poison the well with bad entropy and increase by a small but significant amount the chance of guessing your keys. OK, so you could the data from many sources, but that would add latency so not an option where performance matters and even then if someone gains control of a significant portion of the distributed system (just by standing up lots of hosts) the issue persists. You could also do a bunch of statistical tests, but again that is work that will harm performance and if you are going to that sort of effort anyway you could setup your own random sources (a couple of active Linux boxes, on older Linux kernels running haveged, on newer ones the latter part isn't needed (https://github.com/jirka-h/haveged/issues/57 https://github.com/jirka-h/haveged/issues/57)) and use those tests to make sure those sources are statically safe. So such a service isn't really needed, and where it might be isn't likely to be trusted, so it could exist but as a play-thing not a serious service. On my little home server, not a particularly up to date CPU etc, running 5.10, I can pull >3Gbit/sec from /dev/random. Heck, the Pi400 that is currently my router can hand out ~230Mbit/sec or entropy.

throwaway81523 4y ago

This is a randomness distillation function that gets entropy from a system source like linux getrandom() or the OpenSSL RNG. It's nice but it is purely computational. It doesn't harvest entropy on its own, if that is what you were hoping.

lxgr 4y ago
> It doesn't harvest entropy on its own, if that is what you were hoping. I'm actually hoping that userspace applications stop attempting any such thing if it can be at all avoided (and on most systems, it can).
ilyt 4y ago
Why it would need to "distill" anything on modern Linux/BSD?
- throwaway81523 4y ago
  I think the idea is to be fast by avoiding system calls and using fast primitives underneath, and to unreversibly garble the internal state quickly. I don't see very obvious applications for this though. If you think your computer is leaking internal state, you have bigger problems. Otherwise, use getrandom() to seed your favorite stream cipher. I do want to look at this more closely, because if DJB thinks it is worthwhile, there is likely to be something to it. But it doesn't jump out at me after the quick glance that I took.
  - ilyt 4y ago
    Well the lib is from 2008 where randomness story looked worse. Might be worthwhile back then. Also > Another virtue of having a randombytes() abstraction layer is that test frameworks can substitute a deterministic seeded randombytes() providing known pseudorandom bytes for reproducible tests. Of course, the randombytes() provided by these test frameworks must be kept separate from the fresh randombytes() used for deployment.

olliej 4y ago

arc4random() has existed to produce cryptographically random values for well over a decade (and despite the name, on Mac at least is not rc4 based and I assume Linux is the same). Additionally windows and Darwin/xnu have API to get large arrays of random values and I again will just assume Linux does too. This library should not be doing anything other than wrapping the specific api provided by the host platform.

1vuio0pswjnm7 4y ago

Small program to generate random bytes to stdout, using original 2008 randombytes() function that presumably inspired librandombytes. Usage: a.out number_of_bytes For example, a.out 128 > data od -tx1 -An < data Taken from public domain source code by djb and jmojzis. Tested on Void Linux with musl. #include <stdlib.h> #include <unistd.h> #include <sys/types.h> #include <fcntl.h> #include <poll.h> #include <errno.h> #include <sys/stat.h> int strtonum(long long *,const char *); int strtonum(long long *r,const char *buf){ char *bufpos=(char *)buf; int flagsign=0; long long i; unsigned long long c,ret=0; if (!buf) goto failed; switch(buf[0]){ case 0: goto failed;break; case '+': ++bufpos;break; case '-': flagsign=1;++bufpos;break; default: break; } for(i=0;bufpos[i];++i){ c=bufpos[i]-'0'; if(c<0||c>9)break; c+=10*(ret); if(ret>c)goto failed; ret=c; } if(i==0)goto failed; if(flagsign){*r=-ret;if(*r>0)goto failed;} else{*r=ret;if(*r<0)goto failed;} return 1; failed: *r=0; errno=EINVAL; return 0; } int writeall(int,const void *,long long); int writeall(int fd,const void *xv,long long xlen) { const unsigned char *x=xv; long long w; while(xlen>0){ w=xlen; if(w>1048576)w=1048576; w=write(fd,x,w); if(w<0){ if(errno==EINTR||errno==EAGAIN||errno==EWOULDBLOCK){ struct pollfd p;p.fd=fd;p.events=POLLOUT|POLLERR; poll(&p,1,-1);continue; } return -1; } x += w; xlen -= w; } return 0; } void randombytes(unsigned char *,unsigned long long); /* it's really stupid that there isn't a syscall for this */ static int fd = -1; void randombytes(unsigned char *x,unsigned long long xlen) { int i; if(fd==-1){ for(;;){ fd=open("/dev/urandom",O_RDONLY); if(fd!=-1)break; sleep(1); } } while(xlen>0){ if(xlen<1048576)i=xlen;else i=1048576; i=read(fd,x,i); if(i<1){sleep(1);continue;} x+=i;xlen-=i; } } int fsyncfd(int); int fsyncfd(int fd){ struct stat st; if(fstat(fd,&st)==0&&S_ISREG(st.st_mode)){ if(fsync(fd)==-1)return -1;} return 0; } void byte_zero(void *,long long); void byte_zero(void *yv,long long ylen){ long long i;char *y=yv; for(i=0;i<ylen;++i)y[i]=0; } static unsigned char buf[4096]; int main(int argc,char **argv){ long long i,l; if(!strtonum(&l,argv[1])||l<0)exit(0); byte_zero(buf,sizeof buf); while(l>0){ i=l; if(i>sizeof buf)i=sizeof buf; randombytes(buf,i); if(writeall(1,buf,i)==-1)exit(0); l-=i; } if(fsyncfd(1)==-1)exit(0); exit(0); }

josephg 4y ago

How does this compare to what you get from one of the csprngs in rust's rand crate? I'm not sure when I'd use this. https://rust-random.github.io/book/guide-rngs.html#cryptographically-secure-pseudo-random-number-generators-csprngs https://rust-random.github.io/book/guide-rngs.html#cryptogra...

greenicon 4y ago
There shouldn’t be much of a difference, although the rust crate is more similar to the OpenSSL part. Just make sure to properly seed your CSPRNG, e.g. via using Rust’s ThreadRng[1]. In basically all cases there is no reason to use anything from the rand crate except ThreadRng. 1: https://rust-random.github.io/rand/rand/rngs/struct.ThreadRng.html https://rust-random.github.io/rand/rand/rngs/struct.ThreadRn...
- tptacek 4y ago
  If you have to seed it, you're doing something wrong. You want to be using the system random number generator, the one the kernel provides, in preference to any userland RNG.
  - josephg 4y ago
    ThreadRng is what the GP recommended. From the linked page: > ThreadRng is automatically seeded from OsRng with periodic reseeding (every 64 kiB, as well as “soon” after a fork on Unix — see ReseedingRng documentation for details). Is the system's random number generator actually better than this? It looks like the rand developers know what they're doing, and using a library like this is attractive because I don't have to figure out the "right" random number API on different operating systems. (arc4random()? Is that only a macos thing? srandom()? random()? What is it on windows? Should I be reading from /dev/srandom or something? Etc.)

dogeprotocol 4y ago

Can anyone recommend between Librandombytes and libsodium ramdombytes? https://github.com/jedisct1/libsodium/tree/master/src/libsodium/randombytes https://github.com/jedisct1/libsodium/tree/master/src/libsod...

tptacek 4y ago
If you're using libsodium, use libsodium's randombytes.