Re: arc4random_buf in bcrypt

[Theo de Raadt]

Yup.

> There's an easy way to do this now.
> 
> Index: bcrypt.c
> ===================================================================
> RCS file: /cvs/src/lib/libc/crypt/bcrypt.c,v
> retrieving revision 1.24
> diff -u -p -r1.24 bcrypt.c
> --- bcrypt.c  2 Apr 2008 19:54:05 -0000       1.24
> +++ bcrypt.c  3 Sep 2012 17:29:48 -0000
> @@ -148,15 +148,8 @@ char *
>  bcrypt_gensalt(u_int8_t log_rounds)
>  {
>       u_int8_t csalt[BCRYPT_MAXSALT];
> -     u_int16_t i;
> -     u_int32_t seed = 0;
>  
> -     for (i = 0; i < BCRYPT_MAXSALT; i++) {
> -             if (i % 4 == 0)
> -                     seed = arc4random();
> -             csalt[i] = seed & 0xff;
> -             seed = seed >> 8;
> -     }
> +     arc4random_buf(csalt, sizeof(csalt));
>  
>       if (log_rounds < 4)
>               log_rounds = 4;