From: gus Date: 2006-11-16T03:06:32+09:00 Subject: Re: External entropy pool for random number generator On 11/13/06 7:59 AM, "Yukihiro Matsumoto" wrote: > Hi, > > In message "Re: External entropy pool for random number generator" > on Mon, 13 Nov 2006 19:25:13 +0900, "Kirill Shutemov" > writes: > |> the former is shorter indeed. But it seems more difficult to read the > |> author's intention. Is this useful in cryptography field? > |It allow you specify entropy pool once(in platform specific way) and > |use it anywhere. > > Can you elaborate how much it is useful in general enough to make it > built in? The questions I have are > > * why do we need to call srand every time? > * why do we need to pull a value from entropy pool every time? > * do we really need to enhance rand() to depend on > platform specific feature (/dev/random)? > /dev/random and /dev/urandom are interfaces to a kernel-resident random number generator that is (primarily) designed for use in cryptographic applications that require high-quality random numbers for things like key generation. It is not suitable for general-purpose use because: 0) /dev/random will block when there is a shortage of random bits 1) /dev/urandom won't block, but produces less randomness 2) Other kinds of pseudo-random number generators are often sufficient for most purposes and are usually faster. Seeding a 64-bit linear congruential random number generator from /dev/random so it won't always produce the same sequence is a good compromise for many purposes. I recommend against changing rand() to go to the entropy pool every time. Applications with special requirements should probably not use rand() anyway. -- |regards, |gus |------------------------------------------------------------------- | Gus Bjorklund, Wizard and Vice President, Technology, | Progress Software Corporation, Bedford, Ma. | | "A language that doesn�t affect the way you think about programming | is not worth knowing." � Alan Perlis