Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update OpenSSL-1.1.1-pre9-dev

Browse Source
This commit is contained in:
Hakase
2018-06-21 21:38:00 +09:00
parent 03ea01ad59
commit 5d513892b8
90 changed files with 1039 additions and 553 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man7/RAND.pod
+12 -9
View File
@@ -24,16 +24,19 @@ to be initialized ('seeded') explicitly.
It seeds and reseeds itself automatically using trusted random sources
provided by the operating system.
As a normal application developer, you don't have to worry about any details,
As a normal application developer, you do not have to worry about any details,
just use L<RAND_bytes(3)> to obtain random data.
Having said that, there is one important rule to obey: Always check the error
return value of L<RAND_bytes(3)> and don't take randomness for granted.
return value of L<RAND_bytes(3)> and do not take randomness for granted.
For long-term secrets, you can use L<RAND_priv_bytes(3)> instead.
For values that should remain secret, you can use L<RAND_priv_bytes(3)>
instead.
This method does not provide 'better' randomness, it uses the same type of CSPRNG.
The intention behind using a dedicated CSPRNG exclusively for long-term secrets is
that none of its output should be visible to an attacker (e.g used as salt value),
in order to reveal as little information as possible about its internal state.
The intention behind using a dedicated CSPRNG exclusively for private
values is that none of its output should be visible to an attacker (e.g.,
used as salt value), in order to reveal as little information as
possible about its internal state, and that a compromise of the "public"
CSPRNG instance will not affect the secrecy of these private values.
In the rare case where the default implementation does not satisfy your special
requirements, there are two options:
@@ -61,10 +64,10 @@ of cryptographic principles and understand the implications of your changes.
L<RAND_add(3)>,
L<RAND_bytes(3)>,
L<RAND_priv_bytes(3)>,
L<RAND_get_rand_method(3)>
L<RAND_set_rand_method(3)>
L<RAND_get_rand_method(3)>,
L<RAND_set_rand_method(3)>,
L<RAND_OpenSSL(3)>,
L<RAND_DRBG(7)>,
L<RAND_DRBG(7)>
=head1 COPYRIGHT
doc/man7/RAND_DRBG.pod
+1 -1
View File
@@ -222,7 +222,7 @@ This is in fact done automatically by L<RAND_DRBG_bytes(3)>.
In most cases OpenSSL will automatically choose a suitable seed source
for automatically seeding and reseeding its <master> DRBG. In some cases
however, it will be necessary to explicitely specify a seed source during
however, it will be necessary to explicitly specify a seed source during
configuration, using the --with-rand-seed option. For more information,
see the INSTALL instructions. There are also operating systems where no
seed source is available and automatic reseeding is disabled by default.