Random number generators

[Pedro Giffuni]

On 03/17/15 13:46, Steve Kargl wrote:
> On Tue, Mar 17, 2015 at 10:22:51AM -0700, Dennis E. Hamilton wrote:
>> If you are serious about crypto grade randomness, libc is probably
>> not the answer.  Generally, I don't think reliance on a single
>> generator for general purpose use and for cryptographic quality
>> is going to work well.  This is a very context-sensitive situation
>> and addressing specific threat models against cryptographic PRGs
>> is a very different matter from wanting unpredictable and good
>> quality pseudo-randoms for simulations and other purposes.
>>
> I intrepeted Pedro's original email to mean something better
> than rand(3) and random(3).

You interpreted right. Unfortunately I don't see us changing the POSIX
behavior in libc (specially not in the brutal way OpenBSD did), and even
if we were to change it, we would still have to carry the old version for
compatibility through symbol versioning so the only choice for
interested parties is to add their own implementation, and live with
the bloat of existing versions.

It was really nice to learn about kiss() though.

  Pedro.