veorq / cryptocoding

Guidelines for low-level cryptography software
1.11k stars 90 forks source link

Bad solution for "use strong randomness" #10

Open Sc00bz opened 5 years ago

Sc00bz commented 5 years ago

LibreSSL's getentropy_urandom() calls gotdata() which checks if the data is not all zeros. If you are calling this for short random integers, then all zeros is a very possible random value.