Date: Mon, 27 Nov 2017 18:44:59 +0100 From: Markus Wichmann <nullplan@....net> To: musl@...ts.openwall.com Subject: Re: AES_CTR_DRBG / random numbers On Mon, Nov 27, 2017 at 12:25:23PM -0500, Darcy Parker wrote: > Thanks - that's what I wanted to hear. > It was? I mean, I flat out confirmed your security worries. > Sorry for the retarded question... I wrote this as a user and not a > developer who knows about these things. When I read in the article that > glibc was changing their PRNG, it raised alarms of what else (other than > SSL) could be vulnerable. I accept that if a developer didn't know it is a > documentation problem. Maybe its not as big a deal for libc > implementations as it sounded in that article. > Ah, alright. Sorry for the profanity, then. BTW, the change that actually prevents the issue this article talked about was this new madvise() flag that clears some memory in the child process. That would reliably reset any PRNG. Why glibc are also changing their PRNG algorithm to this AES_CTR_DRBG thingy I don't know. Also BTW, could you please refrain from top-posting? Netiquette and stuff (ease of reading, for the most part). Ciao, Markus
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.