"random PID" - worth to be considered (again) ?
After reading [1] I'm wondering whether these would at least improve OpenSSL's implementation of a RSA key generator (page 13 in [1]) ?
/me knows about the security-by-obscurity discussion like in [2], however here I do not speak about guessing next PID, but about the described entropy hole.
[1] https://factorable.net/weakkeys12.extended.pdf
[2] http://marc.info/?t=94754302700001&r=1&w=2
Signature · 3 lines
MfG/Sincerely Toralf Förster pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3
Quoted 2 lines · Toralf Förster
After reading [1] I'm wondering whether these would at least improve OpenSSL's implementation of a RSA key generator (page 13 in [1]) ?
Random PID's is a terribly way to get entropy into OpenSSL. You don't get that many bits of entropy that way, and what bits of randomness you get is coming from /dev/urandom. So improving the randomness of /dev/urandom is what's important.
Regards,
- Ted