Re: /dev/random in 2.4.6

[daw@mozart.cs.berkeley.edu (David Wagner)]

Alex Bligh - linux-kernel  wrote:
>Equally, I do not want want to read /dev/urandom (and not block) which, in
>an absence of entropy, is (arguably) cryptographically weaker (see below).

This doesn't make any sense to me.  You're using SSL, so you already
have to trust MD5 and SHA.  The only way that /dev/urandom might even
plausibly be in trouble is if those hash functions are broken, but in
this case SSL is in even worse trouble.  If you're using the random
numbers for cryptographic purposes, you might as well use /dev/urandom.
Your fears about weaknesses in /dev/urandom seem to completely unfounded.

There is a perfectly good technical solution available, and it is called
/dev/urandom.  I hope this reassures you...

>The point is simple: We say to authors of cryptographic applications
>(ssl, ssh etc.) that they should use /dev/random, because /dev/urandom
>is not cryptographically strong enough.

Whoever says this is simply wrong.  There are a few isolated scenarios
where /dev/urandom is not sufficient and where /dev/random is needed,
but they are very rare, and they have nothing to do with weaknesses in
/dev/urandom (they have to do with recovering from host compromises,
and they're a second- or third-order concern).