3 ms·
What security problems, exactly? In most settings, a dos attack is an inconvenience. A key compromise a disaster, always. e: dos, not ddos.
by tveita 13y ago
What security problems, exactly?
In most settings, a dos attack is an inconvenience. A key compromise a disaster, always.
e: dos, not ddos.
- tptacek 13y agohttp://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ http://sockpuppet.org/blog/2014/02/25/safely-generate-random...
- tveita 13y agoThat's great. You list a total of zero (0) security issues that have been caused by using /dev/random instead of /dev/urandom for long-lived keys.
- tptacek 13y agoWhat does random or urandom have to do with "long lived keys"? I don't understand the point you're trying to make.
- tveita 13y agoThen I don't understand the point you're trying to make. You have argued that people should always use /dev/urandom, as opposed to the common understanding that /dev/random is safer to use if you need high quality randomness, due to the cold-start issues with urandom. You said that "Not using urandom has caused way, way, way more real-world security problems than any bizarro embedded systems cold start entropy problem ever has.". I asked you for an example of security problems caused by using /dev/random instead of /dev/urandom. You provided a link with no such examples.
- tptacek 13y agoThe common understanding about /dev/random is incorrect. I'm still not reading anything about "long lived keys" in your clarification here. If you are concerned about cold-start entropy on first-ever boot, then seed urandom from random explicitly at boot. There is no reason ever to use /dev/random in crypto code, and you will find that the best crypto code doesn't. I think I'll end my part in this discussion right here.