You didn't even read this one!

> ===================================================================
> RCS file: /cvsroot/src/sys/arch/i386/conf/GENERIC,v
> retrieving revision 1.569
> diff -u -r1.569 GENERIC
> --- i386/conf/GENERIC	2003/08/26 21:12:48	1.569
> +++ i386/conf/GENERIC	2003/09/05 08:14:59
> @@ -163,8 +163,8 @@
>  #options 	GATEWAY		# packet forwarding
>  options 	INET		# IP + ICMP + TCP + UDP
>  options 	INET6		# IPV6
> -#options 	IPSEC		# IP security
> -#options 	IPSEC_ESP	# IP security (encryption part; define w/IPSEC)
> +options 	IPSEC		# IP security
> +options 	IPSEC_ESP	# IP security (encryption part; define w/IPSEC)
>  #options 	IPSEC_DEBUG	# debug for IP security
>  #options 	MROUTING	# IP multicast routing
>  options 	NS		# XNS

And, as state earlier, adding a device to the i386 floppy install
kernel - especially the TINY ones WILL make them exceed their size limits.

I also think that the rnd(4) stuff is inappropriate.
A straight forward, cryptographically secure, random sequence generator
could be used - and wouldn't keep running out of entropy.
The only difficulty is getting enough randomness at the start.

In particular /dev/urandom will quickly drop from being 'very random'
to 'whatever undocumented pseudo-random gererator' outputs.
(especially in an install kernel when little or no entropy is being
generated).

Doing "The output of this hash is mixed back into the pool using the LFSR"
doesn't actually sound cryptographiaclly strong either.

	David

-- 
David Laight: david@l8s.co.uk