Hi! > > > > Thank you for starting this fascinating discussion. I generally agree with everything Jason said. In particular, I am not > > 100% convinced that the extra cost of the premature next defense is justified.(Although Windows and MacOS are adamant it is > > worth it :).) > > Dunno, how big is cost of "premature next" defenses? I believe all you need to do is to reseed in batches, and that does not seem costly at runtime, and does not have high cost in kernel .text. > > But let me give some meta points to at least convince you this is not as obvious as Jason makes it sound. > > > > 1) Attacking RNGs in any model is really hard. Heck, everybody knew for years that /dev/random is a mess > > (and we published it formally in 2013, although this was folklore knowledge), but in all these years nobody > > (even Nadya's group :)) managed to find a practical attack. So just because the attack seems far-fetched, I do not think we should > > lower our standards and do ugly stuff. Otherwise, just leave > >/dev/random the way it was before Jason started his awesome work. Well, practical attacks may be hard, but when they happen... that's bad. We had weak keys generated by debian, we have various devices that with deterministic rngs... Best regards, Pavel -- People of Russia, stop Putin before his war on Ukraine escalates.
Attachment:
signature.asc
Description: Digital signature
