Subject: Random number generator in authsvr

From: "Daniel R. Houle" <[email-masked]>
Date: Thu, 09 Mar 2000 10:53:15 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I've been looking at the authsvr and it's security issue about the
random (or not so-) number generator.  Apparently there is a way to fix
that by changing the rand() and srand() functions.  Anybody done this
already?  Anybody know what I should change these functions to?  Should
I create new ones myself?

Thanks,

Dan Houle

---

From: Rick Murphy <[email-masked]>
Date: Thu, 09 Mar 2000 19:13:00 -0500

At 10:53 AM 3/9/00 -0500, Daniel R. Houle wrote:
>Apparently there is a way to fix that by changing the rand() and srand()
>functions.  Anybody done this already?  Anybody know what I should change 
>these functions to?  Should I create new ones myself?

That depends somewhat on what OS you're using. If it's got a random number 
device (/dev/random) you're far better off using that instead of 
srand()/rand().

Don't use rand/srand - use random/srandom. (Define USE_RANDOM).
The seed used is very poor and tends to have a small range. Does anyone 
have an improved seed calculation to recommend?
         -Rick