Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 07 Nov 2014 22:28:37 +0100
From: Eric Blake <eblake@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: random number generators - rand(), random(),
 etc

On 11/07/2014 10:21 PM, jb wrote:

>>> https://sourceware.org/ml/libc-alpha/2014-11/msg00143.html
>>
>> In general, rand() and random() are not backed by cryptosafe PRNGs and
>> should not be used for security purposes.
>>
>> /mz
>>
>>
> 
> Well, rand() in Linux and ISO C standard are not threadsafe, but random(),
> srandom(), etc in Linux are claimed to be threadsafe:
> 
> - pthread(7) - the function random() is listed as threadsafe
> - random(3)
>   Multithreading (see pthreads(7))
>        The random(), srandom(),  initstate(),  and  setstate()  functions  are
>        thread-safe.
> 
> But apparently they are not.
> 
> A problem ?

Maybe.  But not a security problem, because no security-conscious
program should be using random().  Therefore, I repeat my question -
what do you want this list to do about it?  You're not reaching the
right target audience.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


Download attachment "signature.asc" of type "application/pgp-signature" (540 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.