7

We are using OpenSSL for generating IV's and other random data. We initialize it using RAND_poll and, on Windows, RAND_screen.

The question is though, if the seed generated by those methods is good enough (RAND_screen at least sounds to me like it is). Also, I was wondering how exactly RAND_poll works, as I could not find much documentation about it ant if it does behave differently depending on platform, like RAND_screen which is only available on Windows.

8

RAND_bytes() automatically calls RAND_poll() if it has not already been done at least once. So you do not have to call it yourself. RAND_poll() feeds on what the operating system provides: on Linux, Solaris, FreeBSD and similar Unix-like systems, it will use /dev/urandom (or /dev/random if there is no /dev/urandom) to obtain a cryptographically secure initial seed; on Windows, it will call CryptGenRandom() for the same effect.

RAND_screen() is provided by OpenSSL only for backward compatibility with (much) older code which may call it (that was before OpenSSL used proper OS-based seed initialization).

So the "normal" way of dealing with RAND_poll() and RAND_screen() is to call neither. Just use RAND_bytes() and be happy.

  • Thanks for the detailed answer. In regards to your suggestion to call neither, the problem under Windows is that RAND_poll can take some time and will block our UI. So we call it upon initialization, which works for us. Secondly, do you know what will be the source of randomness on Symbian and if that one is reliable? – inflagranti Sep 29 '11 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.