Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-21 Thread Chet Ramey
On 1/21/19 4:46 PM, Martijn Dekker wrote: > So I think SRANDOM is the best name (or SECURE_RANDOM, though that is a > bit long). I'm OK with SRANDOM. -- ``The lyf so short, the craft so long to lerne.'' - Chaucer ``Ars longa, vita brevis'' - Hippocrates Chet Ramey, UTech, CWRU

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-21 Thread Quentin
On January 20, 2019 2:39:45 PM UTC, Martijn Dekker wrote: >filename_suffix() { > chars=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 >length=${#chars} >for ((i=0; i<10; i++)) do >printf '%s' "${chars:$(( SECURE_RANDOM % length + 1 )):1}" >done >} The char

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-21 Thread Martijn Dekker
Op 21-01-19 om 20:12 schreef Chet Ramey: > On 1/20/19 9:04 PM, Rawiri Blundell wrote: >> For what it's worth I did consider suggesting URANDOM, however I >> figured some users may confuse it like this: >> >> RANDOM -> /dev/random >> URANDOM -> /dev/urandom >> >> Couple that with an established base

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-21 Thread Chet Ramey
On 1/20/19 9:04 PM, Rawiri Blundell wrote: > On Mon, Jan 21, 2019 at 10:54 AM Chet Ramey wrote: >> >> On 1/20/19 7:52 AM, Rawiri Blundell wrote: >> >>> So it might be a case of restricting the usability of this change to >>> newer kernels that have dedicated calls like getrandom() or >>> getentrop

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-21 Thread Robert Elz
Date:Mon, 21 Jan 2019 09:43:17 -0500 From:Chet Ramey Message-ID: <94f6225c-8de2-cd3d-c83e-0d061c8b0...@case.edu> | Take the linux mktemp, add the -c option, Please don't, or at least not the -c option (I don't care if mktemp is made into a builtin, seems unnecessar

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-21 Thread Chet Ramey
On 1/21/19 8:48 AM, Greg Wooledge wrote: > On Sun, Jan 20, 2019 at 03:39:45PM +0100, Martijn Dekker wrote: >> E.g. to create a random character string for a temporary >> file name, you could do >> >> filename_suffix() { >> chars=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 >>

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-21 Thread Greg Wooledge
On Sun, Jan 20, 2019 at 03:39:45PM +0100, Martijn Dekker wrote: > E.g. to create a random character string for a temporary > file name, you could do > > filename_suffix() { > chars=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 > length=${#chars} > for ((i=0; i<10; i++)

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-20 Thread Rawiri Blundell
On Mon, Jan 21, 2019 at 10:54 AM Chet Ramey wrote: > > On 1/20/19 7:52 AM, Rawiri Blundell wrote: > > > So it might be a case of restricting the usability of this change to > > newer kernels that have dedicated calls like getrandom() or > > getentropy(), and having to handle detecting/selecting th

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-20 Thread Chet Ramey
On 1/20/19 8:07 PM, Rawiri Blundell wrote: > */snip* > > So it looks like problem solved? There never was a problem. -- ``The lyf so short, the craft so long to lerne.'' - Chaucer ``Ars longa, vita brevis'' - Hippocrates Chet Ramey, UTech, CWRUc...@case.eduhttp://tisww

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-20 Thread Rawiri Blundell
On Mon, Jan 21, 2019 at 1:36 PM Eduardo A. Bustamante López wrote: > > On Sun, Jan 20, 2019 at 05:22:12PM -0500, Chet Ramey wrote: > > On 1/20/19 4:54 PM, Chet Ramey wrote: > > > > >> As an aside, I can confirm the findings of a performance difference > > >> between 4.4 and 5.0 when running the sc

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-20 Thread Eduardo A . Bustamante López
On Sun, Jan 20, 2019 at 05:22:12PM -0500, Chet Ramey wrote: > On 1/20/19 4:54 PM, Chet Ramey wrote: > > >> As an aside, I can confirm the findings of a performance difference > >> between 4.4 and 5.0 when running the script provided earlier in the > >> discussion. At first glance it seems to be du

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-20 Thread Chet Ramey
On 1/20/19 4:54 PM, Chet Ramey wrote: >> As an aside, I can confirm the findings of a performance difference >> between 4.4 and 5.0 when running the script provided earlier in the >> discussion. At first glance it seems to be due to the switch from the >> old LCG to the current MINSTD RNG, > > T

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-20 Thread Chet Ramey
On 1/20/19 7:52 AM, Rawiri Blundell wrote: > So it might be a case of restricting the usability of this change to > newer kernels that have dedicated calls like getrandom() or > getentropy(), and having to handle detecting/selecting those? > > So if this is an exercise that you're happy to entert

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-20 Thread Martijn Dekker
Op 19-01-19 om 23:10 schreef Chet Ramey: > On 1/19/19 2:45 PM, Martijn Dekker wrote: >> Op 16-01-19 om 02:21 schreef Quentin: >>> If you really need some quality CSPRNG values, I'd suggest adding a >>> $SECURE_RANDOM variable that just reads from /dev/urandom. >> >> IMHO, this would clearly be the

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-20 Thread Rawiri Blundell
> OK, this is a reasonable approach. Since /dev/urandom just generates > random bytes, there's a lot of flexibility and we're not subject to > any kind of backwards compatibility constraints, especially not the > 16-bit limit. What do you think would be the best way to present that > to a user? As

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-19 Thread Chet Ramey
On 1/19/19 2:45 PM, Martijn Dekker wrote: > Op 16-01-19 om 02:21 schreef Quentin: >> If you really need some quality CSPRNG values, I'd suggest adding a >> $SECURE_RANDOM variable that just reads from /dev/urandom. > > IMHO, this would clearly be the correct approach. I don't know of any > 21st ce

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-19 Thread Martijn Dekker
Op 16-01-19 om 02:21 schreef Quentin: > If you really need some quality CSPRNG values, I'd suggest adding a > $SECURE_RANDOM variable that just reads from /dev/urandom. IMHO, this would clearly be the correct approach. I don't know of any 21st century Unix or Unix-like system that doesn't have /de

Re: [bug-bash] $RANDOM not Cryptographically secure pseudorandom number generator

2019-01-15 Thread Quentin
Hello there, I've reviewed both patches and found some things that should be either greatly improved, or buried some place very deep. :-p On 2019-01-07 08:15, Ole Tange wrote: On Mon, Jan 7, 2019 at 12:08 AM Chet Ramey wrote: On 1/5/19 3:12 PM, Eduardo A. Bustamante López wrote: > On Fri,