6 ms·

Here is the patch: http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a8122270236898bf http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a...

• tptacek 13y ago
  Wait, so the patch just IGNORES the case where the CSPRNG isn't initialized?
  • throwaway2048 13y ago
    openbsd is switching openssl to be entirely reliant on its system CSPRNG (/dev/random and/or arc4random (which amusingly enough now uses chacha20 not rc4), which as you frequently recommend, cannot block and functions relying on it cannot fail), all internal RNG functionality is beening ripped out. There will be no CSPRNG to initalize. API/ABI compat will be maintained by NOOPing the functionality.
    • tptacek 13y ago
      That makes a lot of sense. Thanks for the clarity.
  • dlgeek 13y ago
    If the call to BN_BLINDING_create_param() after that code fails, it will throw an error immediately after. I haven't checked the code for that function, but it probably returns error when it tries to use the CSPRNG.
    • X-Istence 13y ago
      The CSPRNG has been replaced with arc4random_buf() in the OpenBSD code, and thus can not fail.
  • X-Istence 13y ago
    Cause there is no CSPRNG anymore: http://freshbsd.org/commit/openbsd/58777eed1cff7c5b34cbc026278f730176a6dbc2 http://freshbsd.org/commit/openbsd/58777eed1cff7c5b34cbc0262... RAND_status() always returns 1.