On Thu, 26 Oct 2000, John Baldwin wrote:

I stated this same objection until I actually attended Mark's presentation at the 'con. The yarrow algorithm uses an encrypted hash for the entropy on the way in, and encrypts the output on the way out. This would make it extremely difficult to guess the state at reboot, even if we weren't picking up new entropy sources during the boot process.

Pending Mark's approval, I'd like to suggest we add a cron job to dump X k of data from /dev/random to a file (/boot/.periodic_entropy maybe?) and use that, AND ${entropy_file:/var/db/entropy} to reseed at boot, and only do the "long, annoying" failover process if neither file exists. The only remaining questions would be how many k of data to dump how often.

Doug

-- "The dead cannot be seduced." - Kai, "Lexx"

Do YOU Yahoo!?

To Unsubscribe: send mail to majo...@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message