Package: libbsd-dev Version: 0.6.0-1 Severity: wishlist Hi,
arc4random in libbsd uses an RC4-based implementation from OpenBSD. Upstream OpenBSD (5.5) has already replaced it with ChaCha20 and I think it would be a good idea to do the same here. Attacks against RC4 have been getting better. libbsd at least discards the first 3 KBytes of the RC4 keystream as a countermeasure, but I feel uncomfortable about using it indefinitely. Thanks for considering. -- System Information: Debian Release: jessie/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable') Architecture: kfreebsd-amd64 (x86_64) Kernel: kFreeBSD 9.0-2-amd64-xenhvm Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages libbsd-dev depends on: ii libbsd0 0.6.0-1 libbsd-dev recommends no packages. libbsd-dev suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
