Cryptographic weakness on Debian systems

Cryptographic weakness on Debian systems

Posted May 13, 2008 21:15 UTC (Tue) by lambda (subscriber, #40735)
In reply to: Cryptographic weakness on Debian systems by bcl
Parent article: Cryptographic weakness on Debian systems

No, ssleay_rand_bytes is supposed to be returning a random number generated from the current state of the random number generator. It happened to be mixing in some entropy from the (uninitialized) output buffer passed in, which is not particularly helpful nor harmful, other than messing with Valgrind. It's only in the ssleay_rand_add function that commenting out the line causes any particular problems, because the whole point of ssleay_rand_add is to seed the random number generator.

You can check the documentation in man RAND_bytes and man RAND_add for more information on how these are supposed to work.

---

(Log in to post comments)