Problem - Kevin Tafuro

11.7 Using an Entropy Gathering
Daemon–Compatible Solution
Problem
Your application needs randomness, and you want it to be able to run on Unix-based
platforms that lack the /dev/random and /dev/urandom devices discussed in Recipe
11.3—for example, machines that need to support legacy operating systems.
Solution
Use a third-party software package that gathers and outputs entropy, such as the
Entropy Gathering and Distribution System (EGADS). Then use the Entropy Gathering
Daemon (EGD) interface to read entropy. EGD is a tool for entropy harvesting
and was the first tool to export this API.
When implementing our randomness API from Recipe 11.2, use entropy gathered
over the EGD interface in places where entropy is needed; then, to implement the
rest of the API, use data from that interface to seed an application-level cryptographic
pseudo-random number generator (see Recipe 11.5).
Discussion
A few entropy collection systems exist as processes outside the kernel and distribute
entropy through the EGD socket interface. Such systems set up a server process, listening
on a Unix domain socket. To read entropy, you communicate over that interface
using a simple protocol.
One such system is EGADS (described in the next recipe and available from http://
www.securesoftware.com/egads). Another system is EGD itself, which we do not recommend
as of this writing for several reasons, primarily because we think its entropy
estimates are too liberal.
Such entropy collection systems usually are slow to collect good entropy. If you can
interactively collect input from a user, you might want to use one of the techniques
in Recipe 11.19 instead to force the user to add entropy to the system herself. That
approach will avoid arbitrary hangs as you wait for crucial entropy from an EGDcompatible
system.
The EGD interface is more complex than the standard file interface you get when
dealing with the /dev/random device. Traditionally, you would just read the data
needed. With EGD, however, you must first write one of five commands to the
socket. Each command is a single byte of data:
594 | Chapter 11: Random Numbers
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.