On Tue, 07 Jun 2011 19:38:29 -0700, Paul Rubin wrote: >> Personally, I'd take whatever "cheap" entropy I can get and hash it. >> If you're going to read from /dev/urandom, limit it to a few bytes per >> minute, not per request. > > That's really not going to help you.
In what way? If I need security, I'll use /dev/random or /dev/urandom. If I don't, I'll save the real entropy for something which needs it. Issues with observability of entropy sources (mainly the use of network traffic as an entropy source) are overblown. The staff of a co-location facility have physical access, and anyone further out doesn't see enough of the traffic for it to do them any good. Predicting an entropy-hashing RNG based upon a fraction of the entropy and a fraction of the output is a theoretical attack which is only relevant to entities who have far easier options available to them. -- http://mail.python.org/mailman/listinfo/python-list
