/dev/random vs. /dev/urandom and the krb5 test suite

[Simo Sorce]

On Thu, 2009-06-18 at 14:21 -0400, Sam Hartman wrote:
> So, during normal operation I would not expect Kerberos to use
> /dev/random much.
> I'd expect it to get used at
> 
> * kadmind startup
> * kdb5_util usage
> * possibly (but probably not) krb5kdc
> 
> The idea is that long-term cryptographic keys such as TGT keys and
> service keys should use /dev/random to initialize the PRNG.  I would
> not expect the KDC or clients to use /dev/random during normal
> operation nor would I expect startup of KDC and kadmind to use
> non-constant data from /dev/random.
> 
> So, if you do create a krb5.conf option, I think having big warning
> flags would be entirely appropriate.  I don't think you should ever
> need that option in a production environment.

Wouldn't it make more sense to have an environment variable used only
during tests ?

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York