Re: $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-07 Thread Ole Tange
On Mon, Jan 7, 2019 at 9:37 AM Eduardo A. Bustamante López wrote: > On Mon, Jan 07, 2019 at 08:15:12AM +0100, Ole Tange wrote: > > On Mon, Jan 7, 2019 at 12:08 AM Chet Ramey wrote: > > > On 1/5/19 3:12 PM, Eduardo A. Bustamante López wrote: > > > > On Fri, Dec 28, 2018 at 10:24:50AM +0100, Ole

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-07 Thread Eduardo A . Bustamante López
On Mon, Jan 07, 2019 at 08:15:12AM +0100, Ole Tange wrote: > On Mon, Jan 7, 2019 at 12:08 AM Chet Ramey wrote: > > > > On 1/5/19 3:12 PM, Eduardo A. Bustamante López wrote: > > > On Fri, Dec 28, 2018 at 10:24:50AM +0100, Ole Tange wrote: > > > (...) > > >> Patch attached. > : > > > - Does the new

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-06 Thread Ole Tange
On Mon, Jan 7, 2019 at 12:08 AM Chet Ramey wrote: > > On 1/5/19 3:12 PM, Eduardo A. Bustamante López wrote: > > On Fri, Dec 28, 2018 at 10:24:50AM +0100, Ole Tange wrote: > > (...) > >> Patch attached. : > > - Does the new RNG generate uniformly distributed numbers? (Yes) > > - What is the

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-06 Thread Ole Tange
On Sat, Jan 5, 2019 at 9:14 PM Eduardo A. Bustamante López wrote:> > On Fri, Dec 28, 2018 at 10:24:50AM +0100, Ole Tange wrote: > (...) > > Patch attached. : > I applied the Salsa20 RNG patch (slightly modified due to the recent changes > in > variables.c, attached [1]) to the tip of `devel` >

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-06 Thread Chet Ramey
On 1/5/19 3:12 PM, Eduardo A. Bustamante López wrote: > On Fri, Dec 28, 2018 at 10:24:50AM +0100, Ole Tange wrote: > (...) >> Patch attached. >> >> It is basically a copy of the code snippet from Wikipedia with a few >> trivial wrappers. >> >> Apart from using Salsa20 the biggest change is that

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-05 Thread Eduardo Bustamante
On Sat, Jan 5, 2019 at 12:12 PM Eduardo A. Bustamante López wrote: (...) > 2. Performance impact > > The new RNG does more work, and thus, it is expected to have a performance > impact when generating lots of random numbers. I tested 3 systems (2 amd64 > and 1 > armhf) and include the results

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-02 Thread Luuk
On 2-1-2019 02:29, Ole Tange wrote: On Mon, Dec 31, 2018 at 8:12 PM Chet Ramey wrote: : Thanks for the patch. I'll take a look after I release bash-5.0. One question: can you reproduce the same random sequence by using the same seed? That's for backwards compatibility, even if the sequences

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-01 Thread Ole Tange
On Mon, Dec 31, 2018 at 8:12 PM Chet Ramey wrote: : > Thanks for the patch. I'll take a look after I release bash-5.0. One > question: can you reproduce the same random sequence by using the same > seed? That's for backwards compatibility, even if the sequences themselves > differ. Yes. Seeding

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-31 Thread Chet Ramey
On 12/28/18 4:24 AM, Ole Tange wrote: > On Sun, Dec 16, 2018 at 6:41 AM Eduardo Bustamante wrote: > : >> You know no one is stopping you from submitting a patch to actually >> fix the documentation right? (or maybe, you know, submitting an actual >> working patch to change the random generator,

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-28 Thread Ole Tange
On Sun, Dec 16, 2018 at 6:41 AM Eduardo Bustamante wrote: : > You know no one is stopping you from submitting a patch to actually > fix the documentation right? (or maybe, you know, submitting an actual > working patch to change the random generator, not just drop some > irrelevant code snippet

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-17 Thread Chet Ramey
On 12/15/18 5:22 PM, Ole Tange wrote: >>> The reason for my submission was that I needed a bunch of random >>> numbers in a shell script, but I needed them to be high quality. >>> Luckily I did not just assume that Bash delivers high quality random >>> numbers, but I read the source code, and

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-15 Thread Eduardo Bustamante
On Sat, Dec 15, 2018 at 6:08 PM Ole Tange wrote: (...) > But your comment actually emphasizes my point: We _will_ have users > who are naive enough to use $RANDOM in ways you and I would not do, > because we know it is unsafe. > > Let's make those usages a little safer. You know no one is

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-15 Thread Ole Tange
On Mon, Dec 3, 2018 at 9:18 PM Chet Ramey wrote: > On 12/3/18 11:31 AM, Ole Tange wrote: > > On Mon, Dec 3, 2018 at 3:56 PM Chet Ramey wrote: > > > >> There has to be a compelling reason to change this, especially at a point > >> so close to a major release. I would think that a major release

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-03 Thread Chet Ramey
On 12/3/18 11:31 AM, Ole Tange wrote: > On Mon, Dec 3, 2018 at 3:56 PM Chet Ramey wrote: > >> There has to be a compelling reason to change this, especially at a point >> so close to a major release. > > The reason for my submission was that I needed a bunch of random > numbers in a shell

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-03 Thread Eduardo Bustamante
On Mon, Dec 3, 2018 at 9:36 AM Greg Wooledge wrote: > > On Mon, Dec 03, 2018 at 05:31:18PM +0100, Ole Tange wrote: > > Luckily I did not just assume that Bash delivers high quality random > > numbers, but I read the source code, and then found that the quality > > was low. I do not think must

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-03 Thread Greg Wooledge
On Mon, Dec 03, 2018 at 05:31:18PM +0100, Ole Tange wrote: > Luckily I did not just assume that Bash delivers high quality random > numbers, but I read the source code, and then found that the quality > was low. I do not think must users would do that. You're correct. Most users would not have

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-03 Thread Ole Tange
On Mon, Dec 3, 2018 at 3:56 PM Chet Ramey wrote: > There has to be a compelling reason to change this, especially at a point > so close to a major release. The reason for my submission was that I needed a bunch of random numbers in a shell script, but I needed them to be high quality. Luckily I

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-03 Thread Greg Wooledge
On Mon, Dec 03, 2018 at 09:56:33AM -0500, Chet Ramey wrote: > There has to be a compelling reason to change this, especially at a point > so close to a major release. > > You might be expecting too much from bash's random number generator. Is > the problem that its period is at most 2**16? For

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-03 Thread Chet Ramey
On 12/2/18 6:13 PM, Ole Tange wrote: > On Wed, Nov 21, 2018 at 11:45 PM Chet Ramey wrote: >> On 11/21/18 3:07 PM, Ole Tange wrote: >>> 'brand' in variables.c is comparable in size to ChaCha20 and ChaCha20 >>> is not completely broken: >>> https://en.wikipedia.org/wiki/Salsa20 >>> >>> Could we

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-02 Thread Eduardo Bustamante
On Sun, Dec 2, 2018 at 3:14 PM Ole Tange wrote: (...) > Git's use of SHA1 seems to be a prime example of what can go wrong: > https://shattered.io/ What does a PRNG have to do with a hashing function? > Can you elaborate on why you think it is a bad idea to change an > insecure PRNG into a

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-12-02 Thread Ole Tange
On Wed, Nov 21, 2018 at 11:45 PM Chet Ramey wrote: > On 11/21/18 3:07 PM, Ole Tange wrote: > > 'brand' in variables.c is comparable in size to ChaCha20 and ChaCha20 > > is not completely broken: > > https://en.wikipedia.org/wiki/Salsa20 > > > > Could we please replace 'brand' with ChaCha20? > >

Re: $RANDOM not Cryptographically secure pseudorandom number generator

2018-11-21 Thread Chet Ramey
On 11/21/18 3:07 PM, Ole Tange wrote: > 'brand' in variables.c is comparable in size to ChaCha20 and ChaCha20 > is not completely broken: > https://en.wikipedia.org/wiki/Salsa20 > > Could we please replace 'brand' with ChaCha20? What is your application that you need something more complicated