Re: External entropy pool for random number generator

On 11/13/06 7:59 AM, "Yukihiro Matsumoto" <[e-mail]> wrote:

> Hi,
> 
> In message "Re: External entropy pool for random number generator"
>     on Mon, 13 Nov 2006 19:25:13 +0900, "Kirill Shutemov"
> <[e-mail]> writes:
> |> the former is shorter indeed.  But it seems more difficult to read the
> |> author's intention.  Is this useful in cryptography field?
> |It allow you specify entropy pool once(in platform specific way) and
> |use it anywhere.
> 
> Can you elaborate how much it is useful in general enough to make it
> built in?  The questions I have are
> 
>   * why do we need to call srand every time?
>   * why do we need to pull a value from entropy pool every time?
>   * do we really need to enhance rand() to depend on
>     platform specific feature (/dev/random)?
> 

/dev/random and /dev/urandom are interfaces to a kernel-resident random
number generator that is (primarily) designed for use in cryptographic
applications that require high-quality random numbers for things like key
generation.

It is not suitable for general-purpose use because:

0) /dev/random will block when there is a shortage of random bits

1) /dev/urandom won't block, but produces less randomness

2) Other kinds of pseudo-random number generators are often sufficient for
most purposes and are usually faster. Seeding a 64-bit linear congruential
random number generator from /dev/random so it won't always produce the same
sequence is a good compromise for many purposes.

I recommend against changing rand() to go to the entropy pool every time.
Applications with special requirements should probably not use rand()
anyway.

-- 
 |regards,
 |gus
 |-------------------------------------------------------------------
 | Gus Bjorklund, Wizard and Vice President, Technology,
 | Progress Software Corporation, Bedford, Ma.
 |
 | "A language that doesn鵠 affect the way you think about programming
 |  is not worth knowing." Alan Perlis