Re:Myths about /dev/urandom (2014)
by matbess on Saturday August 18, 2018 @12:33AM
(#17786881)
Well written post, I enjoyed it, it makes sense.
The part tearing into the man page was especially excellent!
Following your point a little further.. the thought of updating the man pages with warnings like the following made me laugh:
βAES, SHA-3, RSA, Diffie-Hellman, Elliptic curves, and all those crypto packages you're using, OpenSSL, GnuTLS, Keyczar, your operating system's crypto API, are all theoretically vulnerable to a cryptographic attack. Knowledge of how to do this is not available in the current unclassified literature, but it is theoretically possible that such an attack may exist. If this is a concern in your application, do not use them.β
The part tearing into the man page was especially excellent!
Following your point a little further.. the thought of updating the man pages with warnings like the following made me laugh:
βAES, SHA-3, RSA, Diffie-Hellman, Elliptic curves, and all those crypto packages you're using, OpenSSL, GnuTLS, Keyczar, your operating system's crypto API, are all theoretically vulnerable to a cryptographic attack. Knowledge of how to do this is not available in the current unclassified literature, but it is theoretically possible that such an attack may exist. If this is a concern in your application, do not use them.β