New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

arc4random is not based on ARC4 anymore #1

Closed

rfc1459 opened this issue Apr 27, 2014 · 3 comments

rfc1459 commented Apr 27, 2014

The reference implementation of arc4random(3) in OpenBSD was deemed unsafe and was replaced with a PRNG based on ChaCha20 in October 2013.

The arc4random() function provided in crypto/compat still uses the unsafe version.

The text was updated successfully, but these errors were encountered:

Owner

busterb commented Apr 28, 2014

Looking at updating it now. The same issue is in the arc4random(3) implementation in libbsd, where this one came from.

Owner

busterb commented May 2, 2014

Fixed in 089aaf7

busterb closed this as completed

Owner

busterb commented May 2, 2014

For reference, the original version here was based on http://cgit.freedesktop.org/libbsd/tree/src/arc4random.c

The updated version incorporates changes from openbsd-compat/arc4random.c in
http://mirror.esc7.net/pub/OpenBSD/OpenSSH/portable/openssh-6.6p1.tar.gz

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment