How to safely generate a random number

Re:How to safely generate a random number by tptacek on Tuesday February 25, 2014 @09:23PM (#7302369)

The article (I'm its author) is about programming; it doesn't have strong opinions about how you e.g. configure nginx.

As for keys: it depends on the kinds of keys you're generating. If you're building on OpenSSL's primitives --- which, don't --- it'll be hard to get an RSA key without invoking the OpenSSL CSPRNG. But it's not at all hard to avoid OpenSSL's CSPRNG for AES.

[ Parent | on HN ]

Re:How to safely generate a random number by jbaudanza on Tuesday February 25, 2014 @10:00PM (#7302574)

Thanks for clarifying.

My project depends on bitcoin-ruby, which uses OpenSSL's EC_KEY_generate_key to generate keys. EC_KEY_generate_key, as far as I can tell, uses OpenSSLs internal PRNG. If I understand you correctly, this is unsafe and it would be better to derive a key from urandom.

[ Parent | on HN ]

Re:How to safely generate a random number by tptacek on Tuesday February 25, 2014 @10:08PM (#7302612)

Reliance on OpenSSL's CSPRNG isn't a hair-on-fire problem; if it was, your hair would literally be on fire right now, because lots of things do. I just don't think it's a great idea for new code to perpetuate the habit.

[ Parent | on HN ]