Subject: Re: Random number generator in authsvr

From: Joseph S D Yao <[email-masked]>
Date: Wed, 19 Apr 2000 12:53:05 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

On Thu, Mar 09, 2000 at 10:53:15AM -0500, Daniel R. Houle wrote:
> I've been looking at the authsvr and it's security issue about the
> random (or not so-) number generator.  Apparently there is a way to fix
> that by changing the rand() and srand() functions.  Anybody done this
> already?  Anybody know what I should change these functions to?  Should
> I create new ones myself?

I don't know how far you've gotten on this yet, but please consult
Knuth before rolling your own random number generator.  As he says,
most randomly generated random number generators ... aren't.

If the problem is a non-random seed, Marcus Ranum suggested for a
similar problem [and referring to FWTK]:

>				... I also included a utility for generating
> keys but it didn't use very good randomness. If you want to generate
> keys nowadays, why don't you just take a bunch of output from /dev/random
> and run it through od and a sed script? If you haven't got /dev/random
> just run a bunch of ps, uptime, netstat -a, df -i, ls -l /var/log
> piped through sha.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Rick Murphy <[email-masked]>
Date: Wed, 19 Apr 2000 16:33:53 -0400

>similar problem [and referring to FWTK]:
That's precisely the problem. If you've got a /dev/random lying around, use 
that. The range of random seed values that the FWTK random number generator 
creates is small enough to be quite worrying.
         -Rick