Re: ssh, /dev/urandom
Alfred a écrit :
> I support the addition of ssh, *even* with a weak random.
> There was never any talk about removing ssh.
> Now, what's current best practice? We use this:
> http://kilobug.free.fr/hurd/random-64.tar.gz
> Is there a better alternative(s)?
> Or you can copy /bin/bash to /dev/urandom, they are just about equally
> secure.
Of course not, since each time one app open /dev/urandom it gets the _same_
"random" data, which _absolutely_ not what you want. And I'm not sure at all
data are really "uniform" in bash or whatever. So yes, copying bash is worse,
and there is absolutely no cost to use the random translator as /dev/urandom.
And /dev/urandom is not really done for "cryptographic secure" randomness,
it's the goal of /dev/random, not /dev/urandom (and AFAIK ssh only uses
/dev/random for generating the keys).
--
Gael Le Mignot "Kilobug" - kilobug@nerim.net - http://kilobug.free.fr
GSM : 06.71.47.18.22 (in France) ICQ UIN : 7299959
Fingerprint : 1F2C 9804 7505 79DF 95E6 7323 B66B F67B 7103 C5DA
Member of HurdFr: http://hurdfr.org - The GNU Hurd: http://hurd.gnu.org
Reply to: