Thierry Moreau <[email protected]> writes: >I don't see how a security library author can ascertain that the end-user >production environment will indeed provide a good secret random number source.
The problem in this case wasn't a lack of a good secret number source, it was a total absence of any random number source. That isn't too hard to address. Even for a good secret number source, it's not that hard. The only real problem area is deeply embedded environments with little or no access to environmental entropy sources, in which case you need to tell users about the use and protection of random seed files. This one really isn't such a big deal. Peter. _______________________________________________ cryptography mailing list [email protected] http://lists.randombit.net/mailman/listinfo/cryptography
