> I posted this message few days ago, haven't got any feedback yet. Since I
> don't know anywhere else I can ask this, I'm posting it again. Please
> help:
>
> I just wrote a program using OpenSSL crypto library (version 0.9.7b).
> Everything works fine. But I have concerns about whether I should
> seed the
> PRNG and exactly how to do that.
Yes, you should seed the PRNG.
> In my program, I have calls to RSA_generate_key and also RAND_bytes which
> is used to generate a DES key. It's obvious that these functions require
> source of randomness, and in the documentation it also said to seed the
> PRNG before calling them. However, because I couldn't figure out exactly
> what to use to do the seed, I simply called them without doing
> any seeding
> for now. When I run the program, nothing seems to be wrong
> (i.e. RAND_bytes() returns 1, etc.)
I know it sounds obvious, but you use a sequence of random bytes as the
seed.
> So does this mean I do not need to explicitly do the seed?
If you don't, and OpenSSL can't find a source of randomness itself, your
program will either fail or behave insecurely.
> I remember the
> FAQ mentions about some default places where OpenSSL will look for source
> of randomness. So in this case, does that mean it found the source to use?
Probably, assuming your code didn't dupe it into accepting some predictable
bytes as if they were random.
> My program works on both Windows and Linux right now, but can I assume it
> will always be able to find the source?
Linux should have /dev/urandom and Windows should have CryptGenRandom, but
it's a good idea to have a fallback source of your own. You never know when
some Linux machine might not have a /dev/urandom or permissions might be set
to not let you access it.
> If I still should seed the PRNG, could someone explain to me how to
> actually do it? I know I can use RAND_seed, but I don't know what to pass
> to RAND_seed in the buf parameter. The documentation mentions source of
> randomness can come from mouse clicks or things like that, but I have no
> clue how that works. So I'm confused...
You can take anything that is unpredictable and use it. What's the exact
time, to the highest accuracy you can get it, that your program started
running? Exactly how many bytes of memory are free? How many processes are
running? If you receive a packet over the network, at exactly what time did
you get it?
Source of randomness are available all around your program, you just need
to mine them.
DS
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
