The terrible /tmp race handling aside... I suppose then that anyone who attacks a machine which relies on /dev/random -- a world readable device -- should do the following: cat /dev/random > /dev/null & Crypto software which uses those devices should be doing some kind of checking to make sure that they are getting at least good entropy. I suppose I could even argue that the random devices should make it easy for customer software to determine that entropy is low. > On Mon, 31 Jan 2000, Grant Taylor wrote: > > > open RAN, "/dev/random" || die; > > read(RAN,$foo,16); > > close RAN; > > $file = '/tmp/autobuse' . unpack('H16',$foo); > > Please, never use /dev/random or /dev/urandom for such purposes. > > Aside the fact, that it does not help much in what you want to achieve > it is a desaster to system performance because it empties the system's > entropy pool and wastes precious entropy for unneeded things. > > Crypto software _really_ needs these random numbers. > > > -- > Werner Koch at guug.de www.gnupg.org keyid 621CC013 > > Boycott Amazon! - http://www.gnu.org/philosophy/amazon.html
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:33:08 PDT