From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/12976 Path: news.gmane.org!.POSTED!not-for-mail From: Luca Barbato Newsgroups: gmane.linux.lib.musl.general Subject: Re: arc4random/csprng Date: Tue, 3 Jul 2018 16:18:37 +0200 Message-ID: References: <20180702203957.GA9081@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Trace: blaine.gmane.org 1530627413 11198 195.159.176.226 (3 Jul 2018 14:16:53 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Tue, 3 Jul 2018 14:16:53 +0000 (UTC) User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.0 To: musl@lists.openwall.com Original-X-From: musl-return-12992-gllmg-musl=m.gmane.org@lists.openwall.com Tue Jul 03 16:16:49 2018 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.84_2) (envelope-from ) id 1faM6p-0002mq-K6 for gllmg-musl@m.gmane.org; Tue, 03 Jul 2018 16:16:47 +0200 Original-Received: (qmail 9587 invoked by uid 550); 3 Jul 2018 14:18:55 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 9556 invoked from network); 3 Jul 2018 14:18:54 -0000 In-Reply-To: <20180702203957.GA9081@brightrain.aerifal.cx> Content-Language: en-US Xref: news.gmane.org gmane.linux.lib.musl.general:12976 Archived-At: On 02/07/2018 22:39, Rich Felker wrote: > I haven't followed what's been happening with posix_random lately, but > glibc has adding the arc4random interfaces and it seems reasonable > that we should too, with the easy option to add the posix_random name > for it and whatever interface details POSIX decides on. > > The glibc implementation looks like it's essentially CTR mode AES. > This is probably a pretty good choice, but unless there are strong > reasons not to I'd probably rather go with Hash-DRBG or HMAC-DRBG > utilizing the existing SHA-256 code we already have. That would avoid > the need to write or import any new cryptographic code (and the > associated risks) and keep the size cost minimal. This seems better > for forward-secrecy too, but I'd like to better understand the > conditions under which Hash-DRBG and HMAC-DRBG provide > forward-secrecy. >From what I read the various BSDs opted for ChaCha20, not sure which are the trade-offs for this choice thought. lu