4 ms·

I see Yarrow and Fortuna are quite popular, but is there any reason that people shouldn't use stream ciphers like Salsa20 (or RC4 in OpenBSD, I guess) as a CSPR

by TillE 13y ago

I see Yarrow and Fortuna are quite popular, but is there any reason that people shouldn't use stream ciphers like Salsa20 (or RC4 in OpenBSD, I guess) as a CSPRNG? They're designed for nearly identical purposes, and some of them have been pretty well analyzed.

delinka 13y ago
RC4 has shown weaknesses over time [1] that should make any user wary. I'm sure RC4 has its place, but probably not as the sole source of randomness in a Real Security Application®. 1 - https://en.wikipedia.org/wiki/RC4#Biased_outputs_of_the_RC4 https://en.wikipedia.org/wiki/RC4#Biased_outputs_of_the_RC4
- edwintorok 13y ago
  In fact OpenBSD will use Chacha20 in the next version for its arc4random implementation: http://marc.info/?l=openbsd-cvs&m=138065251627052 http://marc.info/?l=openbsd-cvs&m=138065251627052 And I think FreeBSD might follow and switch its implementation too.
  - tptacek 13y ago
    Its implementation of arc4random, you mean; not its /dev/random, right?
    - clarry 13y ago
      replace rc4 with ChaCha20 here, too; ok djm, tedu, deraadt http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/rnd.c.diff?r1=1.144;r2=1.145 http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/rnd.c.diff... http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/rnd.c http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/rnd.c
    - throwaway2048 13y ago
      it is now both /dev/random and /dev/urandom on openbsd
      - clarry 13y ago
        Right, there used to be a number of different random devices, including random, arandom, urandom, prandom, and srandom. Prandom was killed quite some time ago, and as of 2011 all the rest are unified. Four /dev nodes still exist for compatibility, but they all behave identical; so there's really just one random device. The principle being that there's good randomness and there's good randomness. The system does its best to provide good randomness. You can't choose the wrong device.
TallGuyShort 13y ago
Much of the Fortuna design is concerned with accumulating and using entropy effectively - there's more to it than just the random output generator.

by TillE 13y ago

delinka 13y ago

RC4 has shown weaknesses over time [1] that should make any user wary. I'm sure RC4 has its place, but probably not as the sole source of randomness in a Real Security Application®. 1 - https://en.wikipedia.org/wiki/RC4#Biased_outputs_of_the_RC4 https://en.wikipedia.org/wiki/RC4#Biased_outputs_of_the_RC4

edwintorok 13y ago
In fact OpenBSD will use Chacha20 in the next version for its arc4random implementation: http://marc.info/?l=openbsd-cvs&m=138065251627052 http://marc.info/?l=openbsd-cvs&m=138065251627052 And I think FreeBSD might follow and switch its implementation too.
- tptacek 13y ago
  Its implementation of arc4random, you mean; not its /dev/random, right?
  - clarry 13y ago
    replace rc4 with ChaCha20 here, too; ok djm, tedu, deraadt http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/rnd.c.diff?r1=1.144;r2=1.145 http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/rnd.c.diff... http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/rnd.c http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/rnd.c
  - throwaway2048 13y ago
    it is now both /dev/random and /dev/urandom on openbsd
    - clarry 13y ago
      Right, there used to be a number of different random devices, including random, arandom, urandom, prandom, and srandom. Prandom was killed quite some time ago, and as of 2011 all the rest are unified. Four /dev nodes still exist for compatibility, but they all behave identical; so there's really just one random device. The principle being that there's good randomness and there's good randomness. The system does its best to provide good randomness. You can't choose the wrong device.

TallGuyShort 13y ago

Much of the Fortuna design is concerned with accumulating and using entropy effectively - there's more to it than just the random output generator.