[openssl-dev] Plea for a new public OpenSSL RNG API
Blumenthal, Uri - 0553 - MITLL
uri at ll.mit.edu
Wed Aug 30 15:22:58 UTC 2017
>> I would do exactly the opposite. “Normal” entropy is fetched from the default sources (/dev/urandom). But
>> when a sensitive (aka long-term) keys are generated, a (portable :) hardware RNG is plugged in and used with
>> RAND_add() equivalent. Reason – in my setup reliable trusted hardware RNG is not always on. If it were, I’d
>> use it as the main entropy source and be done with it.
>
> In general, I would agree with you. In our case, it was a requirement of the
> government to trust only the SmartCard RNG. Since we use it for VPN
> connections with SmartCard authentication this was no problem, because
> the SmartCard must be present in order to initiate the IKEv2 exchange.
Ah, that makes a lot of difference.
> The only tricky part was to deal with temporary failures of the entropy source.
Did you experience that often? How did you deal with it?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5211 bytes
Desc: not available
URL: <http://mta.openssl.org/pipermail/openssl-dev/attachments/20170830/ac6390bb/attachment-0001.bin>
More information about the openssl-dev
mailing list