points by binarycrusader 12 years ago

I'm very much willing to bet the Solaris man page is NOT grossly misleading, since I know the past and present authors / maintainers of the cryptography framework on Solaris personally :-)

Also, one of the Solaris Security Engineers wrote about random number generation on Solaris extensively just last year:

https://blogs.oracle.com/darren/entry/solaris_random_number_...

Some blogs from other Solaris Security engineers:

Valerie Fenwick: http://bubbva.blogspot.com/

Dan Anderson: https://blogs.oracle.com/DanX/

Darren Moffat: https://blogs.oracle.com/darren

...and last, but not least, Enrico Perla (doesn't have a blog at the moment as far as I know) did author this book and is a Solaris Engineer and someone that works on Solaris Security-related things:

http://www.amazon.com/Guide-Kernel-Exploitation-Attacking-Co...

Dylan16807 12 years ago

Okay, you've convinced me, they definitely put in a somewhat weaker urandom. Also that function for getting random numbers with no zero bytes 'for key generation' terrifies me a bit.

  • binarycrusader 12 years ago

    Yeah, Solaris has pretty strong crypto verifications thanks to a great security team :-)

    I'm glad I could provide useful info.