2
votes
1answer
42 views

Usefulness of bcrypt(UUIDv4())

One of my colleagues is working on securing OAuth 2 client IDs and secrets for our OAuth server and he has come up with this scheme where he would not only use UUID v4 to generate random values, but ...
1
vote
2answers
74 views

Reliable random seed for RNG

I want to create my computer passwords with a RNG, but I am thinking about one thing: I would use python to write that script and the RNG is controlled by one seed, most likely the time. If I would ...
12
votes
4answers
3k views

Why OpenSSL can't use /dev/random directly?

I couldn't find the answer for the reason anywhere, even the wiki page doesn't explain it. This seems like using a PRNG for seeding an another PRNG. The first one (/dev/random) may itself be seeded by ...
2
votes
2answers
443 views

How to generate cryptographically strong pseudorandom data very rapidly?

What's the best way to go about generating a fast stream of cryptographically strong pseudorandom data without installing uncommon packages? Drawing from /dev/urandom is far too slow. I had an idea ...
9
votes
2answers
1k views

Java SecureRandom doesn't block? How?

I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
20
votes
3answers
4k views

Is it appropriate to use haveged as a source of entropy on virtual machines?

While looking for solutions to entropy pool depletion on virtual machines, I came across an interesting project called haveged, which is based on the HAVEGE algorithm (HArdware Volatile Entropy ...
16
votes
2answers
444 views

What statistics can be used to identify pseudorandom data?

I'm working on some code that attempts to identify files whose contents appear to be "random". As such, I'm looking for statistical measures that can be used to identify such randomness. I've ...
6
votes
2answers
586 views

How is the available entropy in /dev/random calculated (or estimated)?

It seems (to a non-expert) that /dev/random is acclaimed to be useable as a source of pure random data. However, I am curious as to the analysis of the file /dev/random. /dev/random is a collection ...
10
votes
3answers
1k views

Is a predictable MAC address a risk?

If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will ...
9
votes
2answers
536 views

Can I use hardware random number generation on my computer? Am I already using it?

A lot of computer security depends on encryption: SSL connections, TCP packet sequencing, encrypted files, etc. These depend on random number generation to ensure that attackers can't guess the ...
4
votes
3answers
771 views

Pseudo Random Generator is not initialized from the (entropy pool)?

The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block. But when ...
3
votes
2answers
1k views

/dev/random security holes

I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
13
votes
2answers
1k views

Evaluating the entropy gathering in a PRNG

I'm reviewing the random number generator (expected to be of cryptographic quality) on an embedded device. My point of view here is the operating system and crypto library implementer. I'm ...