Re:LibreSSL on Gentoo
by derefr on Saturday July 12, 2014 @05:12PM
(#8025800)
It sounds like there should be something like a libopenbsdcompat containing arc4random et al., which both these packages would then import+depend on.
[ Parent
| on HN ]
Re:LibreSSL on Gentoo
by AlyssaRowan on Saturday July 12, 2014 @05:49PM
(#8025877)
Now that the glibc leadership changes have taken place, hopefully we can see functions like arc4random, explicit_bzero, timingsafe_bcmp, reallocarray and the other stuff actually appear in glibc where they belong, so no glue will be required.
They are pretty damn useful when you're trying to do secure programming.
(Of course, arc4random should use ChaCha20.)
the function name is arc4random but it's chacha20 http://marc.info/?l=openbsd-cvs&m=138065251627052&w=2
Re:LibreSSL on Gentoo
by AlyssaRowan on Sunday July 13, 2014 @06:37AM
(#8027068)
Indeed, that's my point: don't forget that the name is legacy and slightly misleading.
RC4 is about to get another public result against it, btw.
I think there recently was a proposal for reallocarray in glibc. Not sure what happened to it though.
There's libbsd for Linux, although I can't comment on the quality of its implementation.
Re:LibreSSL on Gentoo
by vezzy-fnord on Sunday July 13, 2014 @07:23AM
(#8027126)
libbsd and gnulib are pretty much just functions copy-pasted out of their original locations into conveniently organized repositories. There's not much to speak of concerning implementation quality.