/dev/random question

[cpghost]

On Mon, 17 Sep 2007 15:50:33 +0200 (CEST)
Wojciech Puchar <wojtek at wojtek.tensor.gdynia.pl> wrote:

> > same Yarrow pseudo-random sequence. If enough of the random data
> > survives at the end of the dvd it may allow an attack against the
> > PRNG.
> >
> > As things stand, Yarrow is secure, but it might not be a few years
> > from now.
> >
> always humans make most of security problems, not programs.

Yes, indeed. This, and poor key management techniques...

> if you need more security simply modify random generation code. even
> if it will be worse after your modification, it will be unique, and
> unknown to attackers. and that's the best protection

Just because it is unknown to attackers doesn't mean that it is
more secure. You can inadvertently produce *less* entropy and
randomness without even noticing it, and cryptanalysts are *very*
good at identifying this with statistical and other mathematical
methods, even without knowing the algorithm used to generate the
random stream. Security through obscurity (even for algorithms
generating random sequences) isn't the way to go if you're really
security-aware.

-- 
Cordula's Web. http://www.cordula.ws/