On 01/25/2010 12:03 AM, Arno Wagner wrote: > On Sun, Jan 24, 2010 at 03:02:05PM +0100, Heinz Diehl wrote: >> On 24.01.2010, Arno Wagner wrote: >> >>> "As a general rule, /dev/urandom should be used for everything >>> except long-lived GPG/SSL/SSH keys." cryptsetup now depends on gcrypt, I will probably rewrite random source to use gcrypt random generators (its RNG can use both /dev/random and /dev/urandom for seeding) In LUKS case, there are four places which need random data: - volume (master) key generation - volume key digest salt and password salt - anti-forensic split for keyslot obfuscation - safe wipe we are talking only only the first (master key) case here, right? Any known problem why not to use gcrypt RNG? (It should internally wrap possible waiting for enugh entropy, FIPS mode etc. No need to duplicate code in cryptsetup.) Milan _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
