Exploit Information Leaks in Random Numbers from Python, Ruby and PHP

Re:Exploit Information Leaks in Random Numbers from Python, ... by tptacek on Wednesday December 05, 2012 @06:10PM (#4879184)

You should pretty much just default to secure random.

/dev/urandom is fine; in Ruby apps, I'd use OpenSSL::Random.random_bytes or ActiveSupport::SecureRandom.random_number.

[ Parent | on HN ]

Re:Exploit Information Leaks in Random Numbers from Python, ... by emboss on Saturday December 08, 2012 @08:24AM (#4891551)

If OpenSSL::Random isn't working (because OpenSSL is not installed for example) there is also SecureRandom in the stdlib. It tries to do the right thing in any situation: Use OpenSSL:Random if available, otherwise it will fall back to what's available in the OS you're on.

[ Parent | on HN ]

Re:Exploit Information Leaks in Random Numbers from Python, ... by Jabbles on Wednesday December 05, 2012 @06:24PM (#4879244)

What cases do you reserve /dev/random for? SSH keygen?

Do those functions just read from /dev/urandom?

[ Parent | on HN ]

Re:Exploit Information Leaks in Random Numbers from Python, ... by tptacek on Wednesday December 05, 2012 @08:02PM (#4879641)

I don't. Just use urandom.

[ Parent | on HN ]