<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif">Bill Cox <waywardgeek@gmail.com> writes:<br>
</font></p>
<p><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"></font><br>
</p>
<div style="color: rgb(33, 33, 33);">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b></b></font></div>
<div>
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div>>"A read from the /dev/urandom device will not block waiting for more entropy.<br>
>As a result, if there is not sufficient entropy in the entropy pool, the<br>
>returned values are theoretically vulnerable to a cryptographic attack on the<br>
>algorithms used by the driver."<br>
<br>
That's taking a very narrow view of the world. If you step back a bit from<br>
the hardcore-crypto-geek perspective and adopt a more general view,<br>
/dev/random would need a warning:<br>
<br>
"A read from the /dev/urandom device will block waiting for more entropy. This<br>
means your application will appear to hang/crash at random intervals, leading<br>
to hard-to-diagnose faults, customer complaints, loss of business, and, if<br>
you're really unlucky, lawsuits".<br>
<br>
So you've got a table that looks roughly like this:<br>
<br>
Geek Normal human<br>
---- ------------<br>
App.blocks waiting for entropy App doesn't work<br>
App doesn't block on entropy App works<br>
<br>
>From which the conclusion is obvious: Don't ever stop waiting for entropy to<br>
appear.<br>
<br>
Peter.<br>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>