RE: [PATCH 1/2] wrapper: add a helper to generate numbers from a CSPRNG

From: rsbecker@nexbridge.com <rsbecker@nexbridge.com>
Date: Nov 17, 2021, 03:05 UTC
Message-ID: <010901d7db5f$fdb4f570$f91ee050$@nexbridge.com>
In-Reply-To: <CAPUEsphYqg4rvvrODL9yYCeL7wkjyR0RcEVaZiYQHy_2D1-oxg@mail.gmail.com>

On November 16, 2021 7:48 PM, Carlo Arenas wrote:

Show 15 quoted lines

> On Tue, Nov 16, 2021 at 4:01 PM <rsbecker@nexbridge.com> wrote:
> >
> > We do link with libcurl and use OpenSSL as a DLL to handle TLS. The
> underlying random source for the nonstop-* configurations as of OpenSSL
> 3.0 are PNRG supplied by the vendor (HPE) on ia64 and the hardware
> rdrand* instructions on x86. I know that part of the OpenSSL code rather
> intimately.
> 
> Older versions of OpenSSL exported (AFAIK) a usable version of
> arc4random_buf() that could have helped here; it seems to still be there in
> libressl[1] which is mostly API compatible and might be worth looking into
> IMHO even if as you pointed out will need an implementation similar to what
> OpenSSL does internally.
> 
> [1] https://cvsweb.openbsd.org/src/lib/libcrypto/arc4random/

I do not see arc4random being used in our builds going back to OpenSSL 1.0.2, which is as far back as I go anyway.