Skip to contentSkip to conversation

"random PID" - worth to be considered (again) ?

DISCUSSION Toralf Förster 2 participants 2 messages Jul 9, 2012

lore
Share & tools
lore
#0 lore raw

After reading [1] I'm wondering whether these would at least improve OpenSSL's implementation of a RSA key generator (page 13 in [1]) ?

/me knows about the security-by-obscurity discussion like in [2], however here I do not speak about guessing next PID, but about the described entropy hole.

[1] https://factorable.net/weakkeys12.extended.pdf
[2] http://marc.info/?t=94754302700001&r=1&w=2

Signature · 3 lines
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3
#1 lore raw
Quoted 2 lines · Toralf Förster

After reading [1] I'm wondering whether these would at least improve OpenSSL's implementation of a RSA key generator (page 13 in [1]) ?

Random PID's is a terribly way to get entropy into OpenSSL. You don't get that many bits of entropy that way, and what bits of randomness you get is coming from /dev/urandom. So improving the randomness of /dev/urandom is what's important.

Regards,

- Ted