[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171127174459.ohhcgm6znlqsdrtb@voyager>
Date: Mon, 27 Nov 2017 18:44:59 +0100
From: Markus Wichmann <nullplan@....net>
To: musl@...ts.openwall.com
Subject: Re: AES_CTR_DRBG / random numbers
On Mon, Nov 27, 2017 at 12:25:23PM -0500, Darcy Parker wrote:
> Thanks - that's what I wanted to hear.
>
It was? I mean, I flat out confirmed your security worries.
> Sorry for the retarded question... I wrote this as a user and not a
> developer who knows about these things. When I read in the article that
> glibc was changing their PRNG, it raised alarms of what else (other than
> SSL) could be vulnerable. I accept that if a developer didn't know it is a
> documentation problem. Maybe its not as big a deal for libc
> implementations as it sounded in that article.
>
Ah, alright. Sorry for the profanity, then.
BTW, the change that actually prevents the issue this article talked
about was this new madvise() flag that clears some memory in the child
process. That would reliably reset any PRNG. Why glibc are also changing
their PRNG algorithm to this AES_CTR_DRBG thingy I don't know.
Also BTW, could you please refrain from top-posting? Netiquette and
stuff (ease of reading, for the most part).
Ciao,
Markus
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
