Re: Re: random number generators - rand(), random(), etc

[Eric Blake <eblake () redhat com>]

On 11/07/2014 10:21 PM, jb wrote:

> > > https://sourceware.org/ml/libc-alpha/2014-11/msg00143.html
> >
> > In general, rand() and random() are not backed by cryptosafe PRNGs and
> > should not be used for security purposes.
> >
> > /mz
>
> Well, rand() in Linux and ISO C standard are not threadsafe, but random(),
> srandom(), etc in Linux are claimed to be threadsafe:
>
> - pthread(7) - the function random() is listed as threadsafe
> - random(3)
>   Multithreading (see pthreads(7))
>        The random(), srandom(),  initstate(),  and  setstate()  functions  are
>        thread-safe.
>
> But apparently they are not.
>
> A problem ?

Maybe.  But not a security problem, because no security-conscious
program should be using random().  Therefore, I repeat my question -
what do you want this list to do about it?  You're not reaching the
right target audience.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Attachment: signature.asc
Description: OpenPGP digital signature