[PATCH v3] Seed random generator in main()

Andrew Bartlett abartlet at samba.org
Wed Jun 17 03:12:55 MDT 2015


On Wed, 2015-06-17 at 08:23 +0200, Volker Lendecke wrote:
> On Wed, Jun 17, 2015 at 05:11:37PM +1200, Andrew Bartlett wrote:
> > In other parts of Samba we just use the generate_random() function,
> > which avoids needing to think about all this.  We have cryptographic
> > random numbers in Samba, we can just use those for this. 
> > 
> > We set up a PRNG using MD4 over a RC4 stream from 40 bytes of random
> > data.  It isn't the best, but it avoids the bad pattern of using
> > srandom() et al, which will just trigger folks either re-using in more
> > important places or alternately writing to us with 'security' warnings
> > about using it. 
> 
> Seen from another angle: The BSD world seems to settle on
> the arc4random family of functions. There's a libbsd
> replacement on Linux for those. Shouldn't we get rid of our
> own random number generator and just use that, possibly with
> the libbsd code in libreplace?

When Ira was last looking at this, I suggested we punt the problem to
the krb5 libs.  That would make us depend on them, but my hope is they
do a better-than-average job of creating random numbers.

Like with crypto, I would really like to be able to use a good quality
external lib for this.  Ideally that lib would also use the new
getrandom() system call, but no library other that libressl does that
yet, as far as I can tell.

The libbsd code looks OK, but this line makes me shudder, fearing for a
repeat of the debian OpenSSL disaster when a similar bug was 'fixed':
http://cgit.freedesktop.org/libbsd/tree/src/arc4random.c#n119

This is only in the fallback code for failure to open /dev/urandom, so
in the long term when we get a getrandom() syscall that problem will go
away, but it just reminds me how hard this really is.

I'm sorry this isn't the clear answer you were looking for,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba




More information about the samba-technical mailing list