Agreed; I'm being conservative about key generation and assuming that any key may be persisted. This is too strong for most transient protocols uses such as DH. Many of the libraries (eg the IP ID generator) can get very far on a little randomness and stirring.
My worry is in the other direction about the OpenSSL stub domain that Dave wants as an interim measure until we have an OCamlSSL. We need to pull in a suitable rng for pvxen before even considering that...
Anil There are two distinct scenarios for key generation - generating a long lived key (say, an SSH host key that's persisted to disk and "never" changes) for which /dev/random is the right choice, and generating immediate keys for an automated process (e.g. SSL session keys), for which /dev/urandom is probably better. It's the same RNG that /dev/random uses, and it's not significantly more reversible than whatever crypto you're generating keys for. The trivial DoS from opening lots of connections and handshaking until the entropy pool runs dry is a much bigger security risk than using /dev/urandom for key generation.
|
