<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">If this is not going to break 99% of users + it improves the interface + the replacement to achieve the same is a few lines of code and is likely to occur in one place in an app, then it seems reasonable to change it to me.<div class=""><div class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;"><br class=""></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 27 Jul 2020, at 11:08 am, Dr Paul Dale <<a href="mailto:paul.dale@oracle.com" class="">paul.dale@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">The RAND_DRBG (crypto/rand/drbg_lib) APIs are quite some mess and sit badly with the move to provider based infrastructure.<div class=""><div class=""><div class="">They are definitely being deprecated in master but without more, the extra layer of indirection and additional complexity generating random numbers will remain.</div></div><div class=""><br class=""></div><div class="">The option I see are:</div><div class=""><br class=""></div><div class="">1. Remove, rather than deprecate, RAND_DRBG in 3.0. This is a breaking change.</div><div class="">2. Bypass RAND_DRBG and live with a breaking change (refer: <a href="https://urldefense.com/v3/__https://github.com/openssl/openssl/pull/12509*pullrequestreview-455396828__;Iw!!GqivPVa7Brio!P_SYCN9POdf1ZT1I7v4h9G_oUTuels90DxKk1JmFkD7HcXsTPr9n0s3FX3XZZo_c2Q$" class="">https://github.com/openssl/openssl/pull/12509#pullrequestreview-455396828</a>)</div><div class="">3. Leave things as they currently are in master.</div><div class=""><br class=""></div><div class="">The first two are breaking changes and will require an OMC vote.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Some pertinent points:</div><div class=""><br class=""></div><div class="">1. RAND_bytes will continue to work as is — this API is perfect for almost everyone.</div><div class="">2. The RAND_METHOD functionality remains — this allows wholesale replacement of OpenSSL’s RNGs if desired.</div><div class="">3. The name EVP_RAND is the working name and might change — this is not relevant to this discussion.</div><div class="">4. The RAND_DRBG APIs are unlikely to be widely used — they were introduced in 1.1.1. The two users I know of (Akamai and NCP) are both fine with them being removed.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Thoughts anyone?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class="">
<div dir="auto" style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Pauli<br class="">-- <br class="">Dr Paul Dale | Distinguished Architect | Cryptographic Foundations <br class="">Phone +61 7 3031 7217<br class="">Oracle Australia</div><div class=""><br class=""></div></div></div></div></div></div></div></blockquote></div><br class=""></div></body></html>