I'm reading https://lwn.net/SubscriberLink/802360/06e2457983b56edb/ … and facepalming. There is so much wrong here I don't even know where to start.
Show this thread
-
Challenge question: what happens when a "slow counter" just so happens to tick between those two calls? Yeah. You need to check 3 times, not 2 (assuming no IRQs to arbitrarily delay the check). And even then it's crude.
Show this thread
The thing is, yes, you can get useful randomness from interesting places in most platforms, but you need to *know the platform*. This hack, well, it's probably going to give you just about enough entropy in 90% of cases. The other 10%? Pray.
-
-
But isn't that's the whole point of this backup facility: to jump in when no other, more platform-specific facility does it smarter?
-
Adding faketropy where none was there previously just masks lack of entropy problems and will result in people shipping more vulnerable systems because nobody will notice until everyone's got your private keys.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.