On Mon, Dec 21, 2015 at 08:52:16PM -0600, David Young wrote: > > I think Alistair is concerned that the implementation of "NIST SP800-90 > CTR_DRBG" could be incorrect, or else that it could be embedded in > a system in which the correct behavior is not, for whatever reason, > manifest in the userland output. Thus the statistical properties of the
Let me be crystal clear: I sent the mailing list a patch which in no way changes anything that even directly calls the CTR_DRBG. The patch I sent (and on which I asked for comment *which I foolishly, it seems, assumed would come from people who had actually read the patch!*) does not get within a mile of the goddamned CTR_DRBG. Of course if you want to know if the CTR_DRBG works right, it is entirely sensible to run statistical tests on its output! However, it takes a pretty determined reader, I would say, to look at the beginning of this discussion and actually believe that's what we were talking about; and one who is either sorely mislead, sorely misinformed, *or is rudely commenting in a basically off-topic way without actually reading the code* to think that the patch I actually posted (again, for crying out loud, has anyone commenting even read it?) would plausibly make any difference in the CTR_DRBG's output at all. Thor
