Re: Patch: new random pseudodevice

[Alan Barrett <apb%cequrux.com@localhost>]

On Fri, 09 Dec 2011, Thor Lancelot Simon wrote:
> On Fri, Dec 09, 2011 at 12:14:40PM -0500, Thor Lancelot Simon 
> wrote:
> > Let me put it this way: before, you may have thought you were 
> > getting some kind of "true" randomness.  You weren't.  Now, 
> > you still aren't, but at least what sits between you and the 
> > entropy source is a lot more clear, and a lot better analyzed.

I am not knowledgeable enough to comment on that, so I'll take 
your word for it.

> However, when applications use /dev/random, we could consider a 
> "request" to be a single read from the device.  This also has 
> the appealing property that it aligns with how the underlying 
> generator (CTR_DRBG) counts "requests".  That way, in practice, 
> each read from /dev/random would get a fresh AES key -- and most 
> application reads from /dev/random, which may block, are very 
> small.
>
> I think that, in practice, that is about as close to meeting the 
> expectations of the application authors as possible.

I like that idea.

--apb (Alan Barrett)