Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are using OpenSSL for generating IV's and other random data. We initialize it using RAND_poll and, on Windows, RAND_screen.

The question is though, if the seed generated by those methods is good enough (RAND_screen at least sounds to me like it is). Also, I was wondering how exactly RAND_poll works, as I could not find much documentation about it ant if it does behave differently depending on platform, like RAND_screen which is only available on Windows.

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

RAND_bytes() automatically calls RAND_poll() if it has not already been done at least once. So you do not have to call it yourself. RAND_poll() feeds on what the operating system provides: on Linux, Solaris, FreeBSD and similar Unix-like systems, it will use /dev/urandom (or /dev/random if there is no /dev/urandom) to obtain a cryptographically secure initial seed; on Windows, it will call CryptGenRandom() for the same effect.

RAND_screen() is provided by OpenSSL only for backward compatibility with (much) older code which may call it (that was before OpenSSL used proper OS-based seed initialization).

So the "normal" way of dealing with RAND_poll() and RAND_screen() is to call neither. Just use RAND_bytes() and be happy.

share|improve this answer
    
Thanks for the detailed answer. In regards to your suggestion to call neither, the problem under Windows is that RAND_poll can take some time and will block our UI. So we call it upon initialization, which works for us. Secondly, do you know what will be the source of randomness on Symbian and if that one is reliable? –  inflagranti Sep 29 '11 at 15:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.