Re: [PATCH] Reseed PRNG on PID change

2014-01-17 Thread Florian Weimer
On 01/16/2014 05:03 PM, David Jacobson wrote: If you want to make sure they diverge, and make sure that multiple forks diverge differently, you should push in the process ID. Pushing in time helps with (but does not perfectly cure) the virtual machine copying problem. So I suggest pushing in the

Analysis of random API

2014-01-17 Thread Joseph Birr-Pixton
Greetings, I performed an analysis of the RAND_bytes/RAND_pseudo_bytes API and its callers. My write up is here: http://jbp.io/2014/01/16/openssl-rand-api/ Feedback gratefully received. There's a pull request as a result of this: https://github.com/openssl/openssl/pull/38 I think this change

Re: [PATCH] Reseed PRNG on PID change

2014-01-17 Thread David Jacobson
On 1/16/14 4:57 AM, Dr. Stephen Henson wrote: On Thu, Jan 16, 2014, Florian Weimer wrote: The additional resolution of a tick counter might make reseeding after fork unnecessary, but it's difficult to be sure. Something not based on timing information looks desirable to me. I should point ou