Re: How good a random source is Crypto API?
In message <200504040653.j346rRVU006784@mail09.syd.optusnet.com.au> on Mon, 4 Apr 2005 16:53:21 +1000, "Steven Reddie" <firstname.lastname@example.org> said:
smr> Moving such functionality out-of-process would improve stability,
smr> and this is obviously where prngd/egd comes in, but if these are
smr> seen as useful for more secure applications then it seems that a
smr> default OpenSSL install could settle for CryptoAPI's PRNG.
Except for the small matter of knowing what the seeding generator uses
as sources. As was mentioned, Microsoft is very secretive about the
sources used for CryptGetRandom(). prngd/egd are open source...
BTW, OpenSSL does use the CryptoAPI PRNG *as well*, just FYI...
I do understand the problem with crashing systems. Do you have an
idea on how to make things more stable in that kind of situation, and
still have a more varied set of randomness sources than just
Please consider sponsoring my work on free software.
See [url]http://www.free.lp.se/sponsoring.html[/url] for details.
Richard Levitte [email]email@example.com[/email]
"When I became a man I put away childish things, including
the fear of childishness and the desire to be very grown up."
-- C.S. Lewis
OpenSSL Project [url]http://www.openssl.org[/url]
Development Mailing List [email]firstname.lastname@example.org[/email]
Automated List Manager [email]email@example.com[/email]