From: khaines@...
Date: 2006-11-14T02:26:48+09:00
Subject: Re: External entropy pool for random number generator

On Sun, 12 Nov 2006, Kirill Shutemov wrote:

> In the attachment patch which allow to use external entropy pool for
> Kernel::rand.
>
> When entropy pool present and you run Kernel::rand it reads 4(should
> be more?) bytes from pool and use this value as random seed. When pool
> ends(EOF reached) it sets to nil.
>
> It can be useful for cryptography or for testing. For example:
>
> srand(File.open("/dev/random")) # use system entropy pool
> rand
> srand # use standart ruby's generator

This feels like something that is best left as an extension instead of a 
change to the Ruby core.

The Mersenne Twister produces a high quality random number stream for 
non-cryptographic purposes, and having the random number system for Ruby 
be simple and uncomplicated is nice.

If one needs random numbers for cryptographic purposes, it's trivial to 
read numbers from a system entropy pool if one needs that.  That has a lot 
of drawbacks if one needs a lot of randomness, though.

For most cryptographic uses or simulation uses where one needs independent 
streams of random numbers, the best bet is to use a PRNG, seeded with 
entropy from a pool like /dev/random, that is known to produce high 
quality, cryptographically secure streams of numbers.  Where OpenSSL is 
available, one can use the PRNG in it.  One can also use something like 
Crypt::ISAAC, which is a pure ruby implementation of the ISAAC algorithm 
(I have a much faster C version sitting here waiting for me to finally 
push a new release).

I think this sort of interface over /dev/random is best written as an 
extension as well, leaving the Ruby core alone.


Kirk Haines