"Edward J. Sabol" <[EMAIL PROTECTED]> writes:
> Anyway, the current SSL implementation will only work on systems
> with a /dev/random. Additional code is needed to gather entropy from
> other sources. (You'd think OpenSSL would be sophisticated enough
> to do that automatically, but it's not.)
Same here. But it appears to be a feature of sorts. Apparently
earlier versions of OpenSSL worked with the random number generator
unseeded, but were more susceptible to an attack. The maintainers
then decided that it is better for the library to flat out refuse to
work rather than produce unacceptably sub-standard results, a decision
not entirely unreasonable.
Of course, they could have coded the "alternative" the kind of which
cURL implements there, but they probably considered that the
application should be the one to decide on the sources of entropy it
considers appropriate. Again, a defendable choice.
Since I know next to nothing about SSL, cryptography, and randomness,
fixing this is low on my personal list of priorities, but I will
gladly accept patches that do the proper seeding.
On a side note, I'm genuinely amazed at how few bug reports we've
received about SSL being completely broken on non-/dev/random
platform. Either all the SSL people are using Linux or SSL is not as
popular as I thought.
