[PATCH] Adding diversity for security

[Stephen Crane]

Looking into this a bit further, it seems that the OpenSSL RNG is not 
thread-safe (without locks, which the API for is rather messy). As such, 
it is probably better to initialize one RNG per thread, which rand.h 
does not support. Therefore, I'd recommend keeping the existing 
thread-local AES-based RNG...

- stephen

On 10/02/13 10:28, Tom Roeder wrote:
> >From what I've seen, it's been quite stable. Looking back in the git
> logs of openssl, it looks like the last time a change touched rand.h
> was in 2011, and that was just to add FIPS stuff. Then the last change
> before then was in 2009. So, I would say it's safe to rely on it.
>
>
>
> On Wed, Oct 2, 2013 at 10:19 AM, Stephen Crane <sjcrane at uci.edu> wrote:
>> Tom,
>>
>> You make a very good point which I never actually considered. I confess that
>> I am not very familiar with the OpenSS APIL and was simply looking for a
>> drop-in replacement for our existing simple AES implementation, which had a
>> conflicting open-source license. Looking at the the OpenSSL RNG now, I see
>> no problems with it as long as it is stable between versions.
>>
>> - Stephen
>>