Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding notice for depletion of /dev/*random #7

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Adding notice for depletion of /dev/*random #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,7 @@ A good example of the type of analysis to strive for can be shown in Jacob Appel
* Cryptographic Key Generation should be done carefully
* Key Generation should generally not be done on device startup, as the device may be in a low or no-entropy state
* Should use a blocking source of randomness
* Should not deplete the randomness source by using blocked IO (e.g. fopen(/dev/random)+fread(), see http://stackoverflow.com/questions/8699397 )
* Special care should be taken if it is an embedded device or the quality of randomness is suspect
* One party should not be able to control a key entirely in a shared-generation scenario
* Keys should not be mathematically related, but instead derived through pseurandom mixing functions (hash functions)
Expand Down Expand Up @@ -473,4 +474,4 @@ This document was primarily authored by Tom Ritter. It would be impossible to li

# Licensing

This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License: http://creativecommons.org/licenses/by-sa/3.0/
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License: http://creativecommons.org/licenses/by-sa/3.0/