/dev/random vs. /dev/urandom and the krb5 test suite

Simo Sorce ssorce at redhat.com
Thu Jun 18 14:38:35 EDT 2009

On Thu, 2009-06-18 at 14:21 -0400, Sam Hartman wrote:
> So, during normal operation I would not expect Kerberos to use
> /dev/random much.
> I'd expect it to get used at
> * kadmind startup
> * kdb5_util usage
> * possibly (but probably not) krb5kdc
> The idea is that long-term cryptographic keys such as TGT keys and
> service keys should use /dev/random to initialize the PRNG.  I would
> not expect the KDC or clients to use /dev/random during normal
> operation nor would I expect startup of KDC and kadmind to use
> non-constant data from /dev/random.
> So, if you do create a krb5.conf option, I think having big warning
> flags would be entirely appropriate.  I don't think you should ever
> need that option in a production environment.

Wouldn't it make more sense to have an environment variable used only
during tests ?


Simo Sorce * Red Hat, Inc * New York

More information about the krbdev mailing list