[Bug 222807] PURE entropy sources are harvested but not mixed in. Also, min-entropy low per SP800-90B measurements

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222807

--- Comment #2 from Conrad Meyer <cem at freebsd.org> ---
(In reply to W. Dean Freeman from comment #1)
For this 2nd patch, I don't see any value in making it optional.  Does that
seem reasonable to you or can you make a case for the HBSD_RANDOM_HIGH_ENTROPY
option?

Also re: 2nd patch, this code seems totally broken:

+       fortuna_state.fs_pool[pl].fsp_length = MIN(RANDOM_FORTUNA_MAXPOOLSIZE,
+           fortuna_state.fs_pool[pl].fsp_length +
sizeof(event->he_somecounter) +
+           event->he_size);

Note that fsp_length is of type u_int and RANDOM_FORTUNA_MAXPOOLSIZE is
UINT_MAX.  You aren't doing saturating arithmetic, but instead just
overflowing.

-- 
You are receiving this mail because:
You are the assignee for the bug.