Howdy, On November 20, 2003 06:56 pm, Richard Levitte - VMS Whacker wrote: > So, an idea could be, at least for the hw_ncipher.c/e_ncipher.c code > to use the nCipher RNG only to seed the internal OpenSSL pool. We > made a hack yesterday that gave exactly that effect, and it gave much > better performance than the .5s stalls about every 15th request :).
Well as I see it there are a couple of considerations here. The behavioural demands of the RAND_METHOD interface for plugins are, essentially, defined by history as whatever the builtin software implementation provides. If you want to implement a alternative/supplementary RAND_METHOD, it should expect to get the same treatment as the software RAND_METHOD. So if use of the nCipher RNG can't produce entropy fast enough, it clearly can't be used on its own to provide a replacement PRNG source. I would have expected their driver (or API) to insert some kind of PRNG front-end to the hardware entropy, but perhaps this is not the case. So, one possibility is to make the ncipher RAND_METHOD piggy back on top of software mashing/whitening logic (presumably topping up with hardware entropy from time-to-time) - or just have rand_lib.c treat certain NULLs or flags in RAND_METHOD as an indication to take care of this automatically. This just goes hand-in-hand with needing a RAND_METHOD implementation to furnish what has always been expected from the default builtin vtable. The other thing would be to not set the nCipher RAND_METHOD as a default, and instead have the nCipher engine's "init()" handler offer hardware entropy to whatever *is* the default method. :-) Yeah I know, sick sick sick. This also presents the problem you mentioned of ENGINE_set_default(...,ENGINE_METHOD_ALL) setting the RAND_METHOD anyway. The solution there would need to be to hide the ncipher randomness functionality by not exposing the RAND_METHOD in the ENGINE at all, or by extending the ENGINE API in some way that allows you to set RAND_METHODs, RSA_METHODs, EVP_...<whatever> such that they get ignored by ENGINE API commands that "set defaults". Ie. allow engines to offer implementations purely as utilities, that should not be used as fallbacks (you only get them if you specify them directly on a context-by-context basis). Dunno, what do you think? Cheers, Geoff -- Geoff Thorpe [EMAIL PROTECTED] http://www.geoffthorpe.net/ ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
