关于使用 RAND_load_file 和 RAND_write_file 的良好做法是什么
使用 openssl 时，我被教导使用 RAND_load_file 和 RAND_write_file 来确保库始终使用良好的熵。但是，如果由于文件不存在而导致 RAND_load_file 失败，我需要从其他地方获取熵。假设我使用 /dev/random 或 /dev/urandom 来执行此操作。即使在考虑到我从“不太好的来源”（例如 /dev/urandom）获取初始熵之前该文件不存在，也使用 RAND_write_file 是一个好习惯吗？
When using openssl I've been taught to use RAND_load_file and RAND_write_file to ensure the library uses good entropy at all times. However if RAND_load_file fails because the file does not exist I need to get get entropy from some other place. Let's assume I use /dev/random or /dev/urandom to do this. Is it good practice to use RAND_write_file too even though the file did not exist before considering that I get the initial entropy from a "less good source" such as /dev/urandom?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我做了一些研究并使用了本书中找到的内容以及通用来源，例如这个 我的结论是，一个好的做法是始终使用
RAND_write_file。从书中我了解到应该始终使用 /dev/random ，其次最好是使用RAND_load_file。结论是，即使我的应用程序这次无法读取该文件，我也应该将其写入以供我的应用程序或其他应用程序将来使用。这会导致文件不存在且 /dev/random 不可用的特殊情况。如果我只使用 /dev/urandom 我的种子可能很弱，如果我使用
RAND_write_file种子理论上会很弱。我想在这一点上，这意味着如果您真的很偏执，您永远不想写入该文件，因为这将是播种不良的结果。但是，如果您第一次就知道攻击者不存在，那么您应该没问题，因为攻击者无法知道发生了什么（即文件是否具有良好或可预测的熵）。此外，攻击者无法知道RAND_write_file已被不同应用程序使用了多少次。所以我想这取决于你所处环境的偏执程度；使用
RAND_write_file绝对是良好的公民意识，但如果文件不包含良好的熵，您不想欺骗其他应用程序。I did some research and using the pieces found in this book and generic sources like this one my conclusion is that a good practice is to always use
RAND_write_file. From the book I get that /dev/random should always be used and second best is usingRAND_load_file. That concludes that even if my application could not read the file this time I should write it for future use by my application or other applications.That leads to the special case where the file does not exist and /dev/random is not available. If I only use /dev/urandom my seed is potentially weak and if I use
RAND_write_filethe seed will in theory be weak. I guess at this point it means that if you're really paranoid you never want to write the file since it would be the result of bad seeding. But if you can know the attacker is not present the first time you should be OK since the attacker cannot know what has happened (i.e. if the file has good or predictable entropy). Also an attacker cannot know how many times theRAND_write_filehas been used by different applications.So I guess it depends on the paranoia in your environment; using
RAND_write_fileis definitly good citizenship, but you don't want to fool other applications that the file contains good entropy if it does not.