Re: [dsfjdssdfsd] Any plans for drafts or discussions on here?

["Dan Harkins" <[e-mail]>]

On Wed, January 22, 2014 2:15 pm, Paul Hoffman wrote:
> On Jan 22, 2014, at 12:29 PM, Dan Harkins <[e-mail]> wrote:
>
>> On Wed, January 22, 2014 11:16 am, Paul Hoffman wrote:
>>  I'm still hoping that an Informational RFC on a good DRBG will be
>> generated.
>
> In your mind, who is the intended reader? Implementers of the good DRBG in
> an OS, or in an application, or both?

  If an OS developer feels he needs a DRBG then, yes, this would be for
him. And depending on the application, yes this would be for that
developer too.

>>>> The more people that implement anything will increase the probability
>>>> of
>>>> a broken implementation somewhere, I definitely agree. But it is an
>>>> accepted
>>>> economic truth that relying on a single source for anything is a bad
>>>> idea.
>>>
>>> That seems like a strawman: who says that there is a "single source" of
>>> ideas for how to implement randomness? Three large server OSs (Linux,
>>> FreeBSD, Windows) all do it differently.
>>
>>  The single source is "your OS".
>
> Ah, got it. Are you saying "if you are going to re-implement crypto
> primitives and not trust your OS, and one of the ones you are
> re-implementing is the DBRG, here is a best practice for how to do it"?

  It's not necessarily that you don't trust the OS, it's that you don't trust
that to be your sole source.

  Dan.