Subject: Re: add rnd(4) to install floppy
From: David Laight <firstname.lastname@example.org>
Date: 09/05/2003 10:05:06
You didn't even read this one!
> RCS file: /cvsroot/src/sys/arch/i386/conf/GENERIC,v
> retrieving revision 1.569
> diff -u -r1.569 GENERIC
> --- i386/conf/GENERIC 2003/08/26 21:12:48 1.569
> +++ i386/conf/GENERIC 2003/09/05 08:14:59
> @@ -163,8 +163,8 @@
> #options GATEWAY # packet forwarding
> options INET # IP + ICMP + TCP + UDP
> options INET6 # IPV6
> -#options IPSEC # IP security
> -#options IPSEC_ESP # IP security (encryption part; define w/IPSEC)
> +options IPSEC # IP security
> +options IPSEC_ESP # IP security (encryption part; define w/IPSEC)
> #options IPSEC_DEBUG # debug for IP security
> #options MROUTING # IP multicast routing
> options NS # XNS
And, as state earlier, adding a device to the i386 floppy install
kernel - especially the TINY ones WILL make them exceed their size limits.
I also think that the rnd(4) stuff is inappropriate.
A straight forward, cryptographically secure, random sequence generator
could be used - and wouldn't keep running out of entropy.
The only difficulty is getting enough randomness at the start.
In particular /dev/urandom will quickly drop from being 'very random'
to 'whatever undocumented pseudo-random gererator' outputs.
(especially in an install kernel when little or no entropy is being
Doing "The output of this hash is mixed back into the pool using the LFSR"
doesn't actually sound cryptographiaclly strong either.
David Laight: email@example.com