locks and kernel randomness...

[Warner Losh]

> On Feb 24, 2015, at 1:06 PM, John-Mark Gurney <jmg at funkthat.com> wrote:
> 
>> Historically, a CSPRNG is spelled rand() or random(). So by calling those functions,
>> they are saying they want that. Some callers need more, others do not.
> 
> Citation please?  In my copy of the C99 specification, the rand function
> says nothing about being cryptographicly secure..  and the srand function
> specificly states that after calling srand, rand will be seeded w/
> a unsigned int, or 32bits, so by definition not CSPRNG..
> 
> Also, Single UNIX Specification:
> http://pubs.opengroup.org/onlinepubs/007908799/xsh/rand.html
> 
> has the same definition.
> 
> As for random() from our own man page:
>     The random() function uses a non-linear additive feedback random number
>     generator employing a default table of size 31 long integers to return
>     successive pseudo-random numbers in the range from 0 to (2**31)-1.  The
> 
> oh, and immediately before that, it says:
>     The functions described in this manual page are not cryptographically
>     secure.  Cryptographic applications should use arc4random(3) instead.
> 
> So, I really would like to know where you get the idea the rand() and
> random() are CSPRNG.. Though I'm fine w/ making them so..

Historically algorithmic PRNG is spelled random(). My brain thought that and
typed CSPRNG.

Warner