util-linux: predictable mcookie results [LWN.net]

Package(s):

util-linux

CVE #(s):

Created:

February 14, 2003

Updated:

February 19, 2003

Description:

The util-linux package provides the mcookie utility, a tool for generating random cookies that can be used for X authentication. The util-linux packages that were distributed with Mandrake Linux 8.2 and 9.0 had a patch that made it use /dev/urandom instead of /dev/random, which resulted in the mcookie being more predictable than it would otherwise be. This patch has been removed in these updates, giving mcookie a better source of entropy and making the generated cookies less predictable. Thanks to Dirk Mueller for pointing this out.

Alerts:

Mandrake

MDKSA-2003:016

2003-02-13

(Log in to post comments)

util-linux: predictable mcookie results

Posted Feb 20, 2003 22:13 UTC (Thu) by Ross (subscriber, #4065) [Link]

I mentioned this in another post for this bug fix.
/dev/urandom should be completely unpredictable
provided that you have not:

1) broken SHA-1
or
2) obtained access to the entropy pool

Am I just confused or was this update ultra-paranoia?

util-linux: predictable mcookie results

Posted Mar 3, 2003 12:49 UTC (Mon) by rasumner (guest, #5410) [Link]

I agree, I see almost no reason to prefer /dev/random over /dev/urandom. The only cases that I can think of are

i) 128-bits isn't enough entropy (it is, honest)
ii) The machine has just booted (perhaps even for the first time), so that the entropy pool doesn't have enough entropy in it. This might be reasonable say for RedHat's generating an ssh key the first time sshd is started.