Re:Myths about /dev/urandom (2014)
by adrianmonk on Friday August 17, 2018 @11:39PM
(#17786721)
> programmers have a terrible understanding of what "crucial importance" is.
If you cannot understand requirements, you cannot produce satisfactory software.
Anyway, it was intentional that I gave an example where an educated end user is able to make the choice rather than a programmer having to guess.
> The old Linux man page creates the impression that you want "good" random for keys, and "mediocre" random for everything else, which is false.
It certainly is false, and it is a myth that many people believe, but it isn't what I was saying.
> Once you read seeded state, you're done; blocking serves literally no purpose.
As the article explains under the last section ("Not everything is perfect"), /dev/urandom does not guarantee that you are reading seeded state.
Also, those numbers' unpredictability rests on the crypto being really good. Which I'm sure it is, but crypto weaknesses have been discovered in the past. It would be defensible to seek additional protection against that possibility for peace of mind if peace of mind is more important to you than running time and/or availability.
If you cannot understand requirements, you cannot produce satisfactory software.
Anyway, it was intentional that I gave an example where an educated end user is able to make the choice rather than a programmer having to guess.
> The old Linux man page creates the impression that you want "good" random for keys, and "mediocre" random for everything else, which is false.
It certainly is false, and it is a myth that many people believe, but it isn't what I was saying.
> Once you read seeded state, you're done; blocking serves literally no purpose.
As the article explains under the last section ("Not everything is perfect"), /dev/urandom does not guarantee that you are reading seeded state.
Also, those numbers' unpredictability rests on the crypto being really good. Which I'm sure it is, but crypto weaknesses have been discovered in the past. It would be defensible to seek additional protection against that possibility for peace of mind if peace of mind is more important to you than running time and/or availability.