2 ms·
While it's an interesting project (I had fun playing with it) you really shouldn't be relying on remote sources of entropy for security purposes. Generally the
by arkem 13y ago
While it's an interesting project (I had fun playing with it) you really shouldn't be relying on remote sources of entropy for security purposes.
Generally the entropy needs to be secret to be effective so sourcing remote entropy reduces your security to that of the transport security (if any). It's hard to imagine a situation where you have a secure transport mechanism but do not have enough entropy since most encryption schemes that you might use to secure the transmission require secure random number generation.
Disclaimer: I am not a cryptographer, cryptology frightens and confuses me.
- lloeki 13y ago> most encryption schemes that you might use to secure the transmission require secure random number generation. If I understand this correctly, most channel securing schemes require RNG for key exchange (e.g "no prior knowledge" DH key exchange) or pair generation (RSA), then you can move on to a symmetric cipher (whose key is derived from the resulting DH shared secret, or exchanged encrypted via RSA), which requires no RNG (until you want to change the key for PFS). So one can assume scenario where only a quantum of entropy is needed to establish a secure connection, then refuel the entropy bucket with random data transmitted over the now secure yet "non entropy consuming" channel.