Re: Default mcrypt_create_iv() to /dev/urandom

Hi Nikita, On Mar 7, 2014 4:56 PM, "Nikita Popov" <nikita.ppv@gmail.com> wrote: > > Hi internals! > > Currently the mcrypt_create_iv() function uses /dev/random as the default > source for random bytes. This is problematic, because /dev/random will > block if entropy for reseeding the kernel's CSPRNG is estimated to be low. > If mcrypt_create_iv() with default parameters is used in any kind of > user-facing code the blocking will cause unpredictable slowdowns and can be > easily exploited for a denial of service attack. > > /dev/urandom - contrary to popular misconception - is also a > cryptographically safe source of randomness and is recommended over the use It is not, see below. > of /dev/random for most (sometimes all) applications [1] [2] [3] [4] [5]. > Quoting from the /dev/random man page [1]: > > > If you are unsure about whether you should use */dev/random* or > > */dev/urandom*, then probably you want to use the latter. As a > > general rule, */dev/urandom* should be used for everything except > > long-lived GPG/SSL/SSH keys. [*] And that is exactly why it fits on cryptographic safe. See the other discussions about prng, there is a lot of confusion about this wording. :) > One potential issue when using /dev/urandom is that on some systems > (notably Linux, but not BSD) it will not block even if it can't gather > enough initial entropy for seeding the CSPRNG and as such produce > predicable outputs. This condition can only occur immediately after system > startup and as per the /dev/random man page [1] this is mitigated by "all > major Linux distributions [...] since 2000 at least" by saving a seed file. > > As such I would suggest defaulting the mcrypt_create_iv() $source parameter > to MCRYPT_DEV_URANDOM. Objections? I have no objection as uramdom is good enough for 99.999% of php usage. Cheers, Pierre > Nikita > > [*] The latter claim is disputed, see for example the end of [4]. > > [1]: http://man7.org/linux/man-pages/man4/random.4.html > [2]: http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ > [3]: > http://security.stackexchange.com/questions/3936/is-a-rand-from-dev-urandom-secure-for-a-login-key/3939#3939 > [4]: http://blog.cr.yp.to/20140205-entropy.html > [5]: http://www.2uo.de/myths-about-urandom/