<story><title>How secure is Linux&apos;s random number generator?</title><url>http://lists.randombit.net/pipermail/cryptography/2013-July/004728.html</url></story><parent_chain><item><author>tptacek</author><text>Ironically, it&amp;#x27;s particularly vis a vis cryptographic random number generation where we can most easily show open source cryptography failing its users; Debian fatally broke the OpenSSL CSPRNG so badly that attackers could remotely brute force SSH keys.</text></item><item><author>oellegaard</author><text>You are right that closed source doesn&amp;#x27;t mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up every week these days, about hidden backdoors in security software, I trust open source more than ever before.</text></item><item><author>olympus</author><text>Just because something is closed source doesn&amp;#x27;t mean it&amp;#x27;s insecure.  RdRand meets various standards for RNGs and the dieharder tests don&amp;#x27;t show anything of concern.  While you can&amp;#x27;t be 100 percent sure of the reliability of RdRand because you can&amp;#x27;t audit it, I feel safe trusting it for all but the most critical of applications.  Here&amp;#x27;s a blog post describing testing RdRand with dieharder: &lt;a href=&quot;http://smackerelofopinion.blogspot.com/2012/10/intel-rdrand-instruction-revisited.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;smackerelofopinion.blogspot.com&amp;#x2F;2012&amp;#x2F;10&amp;#x2F;intel-rdrand-...&lt;/a&gt;</text></item></parent_chain><comment><author>tankenmate</author><text>Whereas with closed source you would &lt;i&gt;almost never&lt;/i&gt; know. Crypto is very hard to do properly, but at least with open source you have the possibility of independent third party analysis.</text></comment>
<story><title>How secure is Linux&apos;s random number generator?</title><url>http://lists.randombit.net/pipermail/cryptography/2013-July/004728.html</url></story><parent_chain><item><author>tptacek</author><text>Ironically, it&amp;#x27;s particularly vis a vis cryptographic random number generation where we can most easily show open source cryptography failing its users; Debian fatally broke the OpenSSL CSPRNG so badly that attackers could remotely brute force SSH keys.</text></item><item><author>oellegaard</author><text>You are right that closed source doesn&amp;#x27;t mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up every week these days, about hidden backdoors in security software, I trust open source more than ever before.</text></item><item><author>olympus</author><text>Just because something is closed source doesn&amp;#x27;t mean it&amp;#x27;s insecure.  RdRand meets various standards for RNGs and the dieharder tests don&amp;#x27;t show anything of concern.  While you can&amp;#x27;t be 100 percent sure of the reliability of RdRand because you can&amp;#x27;t audit it, I feel safe trusting it for all but the most critical of applications.  Here&amp;#x27;s a blog post describing testing RdRand with dieharder: &lt;a href=&quot;http://smackerelofopinion.blogspot.com/2012/10/intel-rdrand-instruction-revisited.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;smackerelofopinion.blogspot.com&amp;#x2F;2012&amp;#x2F;10&amp;#x2F;intel-rdrand-...&lt;/a&gt;</text></item></parent_chain><comment><author>nwmcsween</author><text>Not defending the debain change but openssl code structure &amp;#x2F; readability is far from great, the only packages I would put behind openssl is libxml2, glib and glibc.</text></comment>