Problem - Kevin Tafuro

It would be nice if you did not have to collect entropy every time a program starts up
or the machine reboots. You should need to get entropy only once per application,
then be able to store that entropy until the next time you need it.
If you have sufficient trust in the local filesystem, you can certainly do this by writing
out a seed to a file, which you can later use to initialize the generator when it
starts back up. Of course, you need to make sure that there are no possible security
issues in file access. In particular, the location you use for saving seed files needs to
be a secure location (see Recipe 2.4 for more on how to ensure this programmatically).
In addition, you should be sure not to store a seed on a potentially untrusted
filesystem, such as an NFS mount, and you should probably use advisory file locking
in an attempt to defeat any accidental race conditions on the seed file.
You should also consider the threat of an insider with physical access to the machine
compromising the seed file. For that reason, you should always strive to add new
entropy to a generator after every startup as soon as enough bits can be collected.
Using a seed file should be considered a stopgap measure to prevent stalling on startup.
See Also
Recipes 2.4, 11.6, 11.20, 11.21
11.18 Statistically Testing Random Numbers
Problem
You are using a hardware random number generator or some other entropy source
that hasn’t been cryptographically postprocessed, and you would like to determine
whether it ever stops producing quality data. Alternatively, you want to have your
generator be FIPS 140 compliant (perhaps for FIPS certification purposes).
Solution
FIPS 140-2 tests, which are ongoing throughout the life of the generator, are necessary
for FIPS 140 compliance. For actual statistical tests of data produced by a
source, the full set of tests provided by FIPS 140-1 are much more useful, even
though they are now irrelevant to the FIPS certification process.
Statistically Testing Random Numbers | 615
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.