Slashdot Mirror

← Back to Stories (view on slashdot.org)

FreeBSD-Current Random Number Generator Broken

Posted by samzenpus on from the protect-ya-neck dept.

First time accepted submitter bobo the hobo writesThe FreeBSD random number has been discovered to be generating possibly predictable SSH keys and SSL certificates for months. Time to regenerate your keys and certs if using FreeBSD-Current. A message to the freebsd-current mailing list reads in part: "If you are running a current kernel r273872 or later, please upgrade your kernel to r278907 or later immediately and regenerate keys. I discovered an issue where the new framework code was not calling randomdev_init_reader, which means that read_random(9) was not returning good random data. read_random(9) is used by arc4random(9) which is the primary method that arc4random(3) is seeded from."

6 of 105 comments (clear)

  1. Is FreeBSD dying? by Anonymous Coward · · Score: 0, Funny

    Netcraft Confirms FreeBSD is dying

    1. Re:Is FreeBSD dying? by FatdogHaiku · · Score: 3, Funny

      Netcraft Confirms FreeBSD is dying

      Facebook is too confusing!
      Don't you have a Twitter link to share?

      --
      You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
  2. I guess this is a problem by Anonymous Coward · · Score: 2, Funny

    According to many people on this site almost every Linux user have now switched to FreeBSD because of Systemd.

  3. That explains hearthstone! by Anonymous Coward · · Score: 2, Funny

    Why do I get both my 7 mana-cost cards on my first two draws?

    Why does the best card in my hand always wind up being the card that gets discarded on random discards?

    Why is the board-clear that I need always at position 30 in the draw pile?

    It is because they built their server backend on FreeBSD!

    It is all so clear now.

  4. How bad was the bug? by Nonesuch · · Score: 5, Funny

    This seems like an odd bug to have happen, how bad were the effects? Just 'weaker' randomness, or without randomdev_init_reader do the random routines just return the same series of pseudorandom digits every time?

    Also, obligatory Dilbert reference

    --

    I do not deploy Linux. Ever.
  5. But it doesn't have SystemD by Billly+Gates · · Score: 2, Funny

    So who cares??

    --
    http://saveie6.com/