Re: [issue1924] mmap - add mmap offset randomisation

--0016363b86f04094400495e3e243
Content-Type: text/plain; charset=ISO-8859-1

Hi,

Last time I checked karc4random() was an in-kernel ARC4 CSPRNG/random number
generator.

Maybe since the last time I checked, someone has ripped that out and
replaced it with a call to the superior
IBAA/L15 in-kernel CSPRNG/random number generator.

I would have to check the sources to find out if that is the case or not;
I'll do it after I finish this reply.

--

To answer your question: ARC4/RC4 is a poor quality CSPRNG/random number
generator, i.e. it is
bad in a number of different ways.

Whereas, the in-kernel IBAA/L15 CSPRNG random numberr generator is vastly
superior in a number of
different ways.

That's why it is better to use it, rather than ARC4/RC4 (karc4random()).

Hope that answers your question.

On 25 November 2010 16:30, Alex Hornung (via DragonFly issue tracker) <
[e-mail]> wrote:

>
> Alex Hornung <[e-mail]> added the comment:
>
> Care to explain the reasoning behind that a bit more? Why is karc4random()
> worse? What are the exact benefit of using the other interface?
>
> I thought karc4random also takes advantage of randomness fed in from
> devices,
> etc.
>
> Cheers,
> Alex
>
> ----------
> status: unread -> chatting
>
> _____________________________________________________
> DragonFly issue tracker <[e-mail]>
> <http://bugs.dragonflybsd.org/issue1924>
> _____________________________________________________
>



-- 
Sincerely,
Robin Carey

--0016363b86f04094400495e3e243
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>Hi,</div>
<div>=A0</div>
<div>Last time I checked karc4random() was an in-kernel ARC4 CSPRNG/random =
number generator.</div>
<div>=A0</div>
<div>Maybe since the last time I checked, someone has ripped that out and r=
eplaced it with a call to the superior</div>
<div>IBAA/L15 in-kernel CSPRNG/random number generator.</div>
<div>=A0</div>
<div>I would have to check the sources to find out if that is the case or n=
ot; I&#39;ll do it after I finish this reply.</div>
<div>=A0</div>
<div>--</div>
<div>=A0</div>
<div>To answer your question: ARC4/RC4 is a poor quality CSPRNG/random numb=
er generator, i.e. it is</div>
<div>bad in a number of different ways.</div>
<div>=A0</div>
<div>Whereas, the in-kernel IBAA/L15 CSPRNG random numberr generator is vas=
tly superior in a number of</div>
<div>different ways.</div>
<div>=A0</div>
<div>That&#39;s why it is better to use it, rather than ARC4/RC4 (karc4rand=
om()).</div>
<div>=A0</div>
<div>Hope that answers your question.<br><br></div>
<div class=3D"gmail_quote">On 25 November 2010 16:30, Alex Hornung (via Dra=
gonFly issue tracker) <span dir=3D"ltr">&lt;<a href=3D"mailto:bugs@crater.d=
ragonflybsd.org">[e-mail]</a>&gt;</span> wrote:<br>
<blockquote style=3D"BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex=
; PADDING-LEFT: 1ex" class=3D"gmail_quote"><br>Alex Hornung &lt;<a href=3D"=
mailto:[e-mail]">[e-mail]</a>&gt; added the comment:<br=
>
<br>Care to explain the reasoning behind that a bit more? Why is karc4rando=
m()<br>worse? What are the exact benefit of using the other interface?<br><=
br>I thought karc4random also takes advantage of randomness fed in from dev=
ices,<br>
etc.<br><br>Cheers,<br>Alex<br><br>----------<br>status: unread -&gt; chatt=
ing<br><br>_____________________________________________________<br>DragonF=
ly issue tracker &lt;<a href=3D"mailto:[e-mail]">bugs@li=
sts.dragonflybsd.org</a>&gt;<br>
&lt;<a href=3D"http://bugs.dragonflybsd.org/issue1924" target=3D"_blank">ht=
tp://bugs.dragonflybsd.org/issue1924</a>&gt;<br>___________________________=
__________________________<br></blockquote></div><br><br clear=3D"all"><br>=
-- <br>
Sincerely,<br>Robin Carey<br>

--0016363b86f04094400495e3e243--