Entropy and DSA key

[Dave Dykstra]

On Tue, Nov 06, 2001 at 05:23:36PM +0100, Lutz Jaenicke wrote:
> I don't see yet, in how far a "one shot" prngd would be different from
> the internal entropy collection code.

It would be the virtually the same but the advantage is it would only have
to be maintained in one place.

> It does cause a delay until enough
> entropy was gathered. Granted, it would allow for a cleaner implementation
> than having the code built-in, but for understandable reasons collecting
> entropy requires the effort to collect the entropy :-)

> Using a seed-save file helps, but somebody could steal it, so that calling
> external gatherers at the time the cryptographic routines are started up
> is an important issue.

I don't buy that argument.  If somebody has the ability to steal your
seed-save file, that means your system has already been compromised so I
don't see the point of trying to secure it further, certainly not at such a
high cost of time spent on every ssh client startup.  I think the only
thing to worry about is an external attacker.

- Dave Dykstra