0005206: Request for stronger random seeding

(0005779)
ygrek (reporter)
2011-01-18 09:08

FWIW, there is support for /dev/random and EGD in cryptokit, probably uuidm should optionally use it (it will not cause binary dependency because of objects).

(0005786)
doligez (manager)
2011-01-20 17:14

The self_init function is only intended for toy examples. If you need serious entropy, you should get it from the OS somehow. We don't provide it through the stdlib because there isn't any good portable way to do that, and providing a function with good entropy on some systems and bad entropy on others would be worse than nothing.

I'll "fix" this by documenting the fact that self_init provides low entropy and advising against its use in serious applications that need high entropy.

(0008027)
xleroy (administrator)
2012-09-06 19:00

Since OCaml 4.00.0, Random.self_init uses /dev/urandom if it is available, so the situation should have improved, at least on platforms that support /dev/urandom (Linux, BSD, MacOS X, Solaris).

I second ygrek's suggestion to use Cryptokit if you need strong pseudorandom numbers.

(0008029)
dbuenzli (reporter)
2012-09-07 01:31

As uuidm is mentioned, I'd just like to add that since v0.9.4 you can define your own random state with the function Uuidm.v4_gen.

Issue History
Date Modified	Username	Field	Change
2011-01-18 01:03	lealanko	New Issue
2011-01-18 09:08	ygrek	Note Added: 0005779
2011-01-20 17:14	doligez	Note Added: 0005786
2011-01-20 17:14	doligez	Assigned To	=> doligez
2011-01-20 17:14	doligez	Status	new => acknowledged
2012-09-06 16:43	doligez	Target Version	=> 4.00.1+dev
2012-09-06 19:00	xleroy	Note Added: 0008027
2012-09-06 19:00	xleroy	Status	acknowledged => resolved
2012-09-06 19:00	xleroy	Resolution	open => fixed
2012-09-06 19:00	xleroy	Fixed in Version	=> 4.00.0
2012-09-06 19:00	xleroy	Target Version	4.00.1+dev =>
2012-09-07 01:31	dbuenzli	Note Added: 0008029

Notes
(0005779) ygrek (reporter) 2011-01-18 09:08	FWIW, there is support for /dev/random and EGD in cryptokit, probably uuidm should optionally use it (it will not cause binary dependency because of objects).

(0005786) doligez (manager) 2011-01-20 17:14	The self_init function is only intended for toy examples. If you need serious entropy, you should get it from the OS somehow. We don't provide it through the stdlib because there isn't any good portable way to do that, and providing a function with good entropy on some systems and bad entropy on others would be worse than nothing. I'll "fix" this by documenting the fact that self_init provides low entropy and advising against its use in serious applications that need high entropy.

(0008027) xleroy (administrator) 2012-09-06 19:00	Since OCaml 4.00.0, Random.self_init uses /dev/urandom if it is available, so the situation should have improved, at least on platforms that support /dev/urandom (Linux, BSD, MacOS X, Solaris). I second ygrek's suggestion to use Cryptokit if you need strong pseudorandom numbers.

(0008029) dbuenzli (reporter) 2012-09-07 01:31	As uuidm is mentioned, I'd just like to add that since v0.9.4 you can define your own random state with the function Uuidm.v4_gen.

Relationships