Mail Archives: cygwin/2002/06/06/06:14:50
On Thu, Jun 06, 2002 at 08:34:30PM +1200, Peter Gutmann wrote:
> Chris Polley <chris DOT polley AT ieee DOT org> writes:
>
> >>I don't know how good the generated entropy is. This question goes to=20
> >>the cygwin list. How generated? How good?
> >
> >It uses the MS-supplied CryptGenRandom call to generate the random bytes.
>
> The CAPI generator is, um, of variable quality. I cover one version in
> http://www.cryptoapps.com/~peter/06_random.pdf. Note that the code appears to
> have changed over time, and is now considerably improved (the details will be
> in the updated version of the above paper). I don't know in which versions of
> Windows the improved versions appeared, or what the specific improvements over
> time may have been.
>
> (Basically, you're relying on the company which brought you ActiveX, Outlook,
> Word macros, IIS, etc etc, to provide secure randomness. It's sort of odd
> that you don't trust their Posix stuff (which is a matter of taste), but do
> trust their randomness (which is a critical security issue) :-).
Typically I don't take that "Microsoft is evil" stuff serious but
the above sentence contains an error. It's not that we don't trust
the Microsoft POSIX stuff but it's not that useable nor complete.
The original reason to create Cygwin was to have a framework in which
gcc and friends will work and which doesn't create licensing trouble
for Cygnus. Every further improvement and extension to Cygwin is
just driven by the will of volunteers.
When I created the /dev/random and /dev/urandom stuff, I decided that
the /dev/random is best implemented by using the OS capabilities and
I still stand to that decision. The /dev/urandom is implemented the
same way but allows falling back to a simple pseudo random number
generator which isn't possible for /dev/random.
By and large I don't see any need to change /dev/random just to support
peoples paranoia.
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Developer mailto:cygwin AT cygwin DOT com
Red Hat, Inc.
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Bug reporting: http://cygwin.com/bugs.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
- Raw text -