Re: Flaw in "random32: update the net random state on interrupt and activity"

On Wed, Aug 5, 2020 at 8:44 AM Marc Plumb [off-list ref] wrote:

I thought net_rand_state was assumed to be insecure and that anyone
could determine the internal state. Isn't this Working as Designed?

I was working as designed - because it wasn't really designed to be
"real crypto" - but sadly it's also the only thing that is fast enough
for a lot of networking.

So it may be _designed_ to be "not real crypto" and to have a
discoverable internal state. But once again, reality interferes, and
it turns out that people really want something very very fast that is
also not deterministic enough to be discoverable at least remotely.

The stuff that is actually designed and intended to be a complete
black box is sadly also much too slow. By about an order of magnitude.

           Linus