Problem - Kevin Tafuro

0x00
Query the amount of entropy believed to be available. This information is not at
all useful, particularly because you cannot use it in any decision to read data
without causing a race condition.
0x01
Read data if available. This command takes a single-byte argument specifying
how many bytes of data should be read, if that much data is available. If not
enough entropy is available, any available entropy may be immediately returned.
The first byte of the result is the number of bytes being returned, so do not treat
this information as entropy. Note that you can never request or receive more
than 255 bytes of entropy at a time.
0x02
Read data when available. This command takes the same argument as the previous
command. However, if not enough entropy is available, this command will
block until the request can be fulfilled. In addition, the response for the command
is simply the requested bytes; the initial byte is not the number of bytes
being returned.
0x03
Write entropy to the internal collector. This command takes three arguments.
The first is a two-byte value (most significant byte first) specifying how many
bits of entropy are believed to be in the data. The second is a one-byte value
specifying how many bytes of data are to be written. The third is the entropic
data itself.
0x04
Get the process identifier of the EGD process. This returns a byte-long header
that specifies how long the result is in bytes, followed by the actual process identifier,
most significant byte first.
In this recipe, we implement the randomness interface from Recipe 11.2. In addition,
we provide a function called spc_rand_add_entropy( ), which provides an interface
to the command for providing the server with entropy. That function does not
allow the caller to specify an entropy estimate. We believe that user-level processes
should be allowed to contribute data to be put into the mix but shouldn’t be trusted
to estimate entropy, primarily because you may have just cause not to trust the estimates
of other processes running on the same machine that might be adding entropy.
That is, if you are using an entropy server that gathers entropy slowly, you do not
want an attacker from another process adding a big known value to the entropy system
and claiming that it has 1,000 bits of entropy.
In part because untrusted programs can add bad entropy to the mix, we recommend
using a highly conservative solution where such an attack is not likely to be effective.
That means staying away from EGD, which will use estimates from any untrusted
Using an Entropy Gathering Daemon–Compatible Solution | 595
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.