Hello. I'm attaching patches for adding the arc4random(3) library function. The
patch includes a manual page. This function uses the free Arcfour (another-rc4)
stream cipher, seeded with entropy. This function is intended for
non-cryptographic uses, such as for mktemp.
As-is this patch takes 128 bits from /dev/urandom, or gettimeofday/getpid
if /dev/urandom is not available. This can be more flexable, to use hp-timing.
I would suggest arc4random() is used in place of hp-timing throughout the Glibc
package, with the exception of the stack protector (for performance reasons),
and use hp-timing in arc4random.c.
Created attachment 1734 [details]
This patch adds --with-prng-device= to allow users to specify their
/dev/urandom or /dev/arandom or /dev/erandom, to use with ssp and arc4random,
Created attachment 1735 [details]
This patch adds the arc4random() code. It depends on the prng patch to build it
Created attachment 1736 [details]
arc4random mktemp/tempname patch
This patch is for tempname.c to make mktemp, and friends, use arc4random().
In resolv/res_init.c, res_randomid() could use arc4random() instead of
glibc is no dumping ground for arbitrary code. The existing code is just find.
Put your code in separate libraries.
Florian Weimer posted another implementation of arc4random() in https://sourceware.org/ml/libc-alpha/2018-05/msg00891.html
I'm working on this.
I am working on a new version for arc4random.
Added on 2.36.