FreeBSD Alpha Port Lack Of /dev/random and /dev/urandom Vulnerability

Distributions of FreeBSD for the Alpha architecture shipped without the /dev/random and /dev/urandom devices. These devices can be used by products and tools to gather entropy for generating cryptographically strong random numbers. Software that does not detect whether opening and reading from the devices fails or not before generating these random numbers may be vulnerable to simplified cryptanalysis against the weakened keys that would be produced. OpenSSL version 0.9.4 and OpenSSH both lacked checks and were vulnerable to this problem.


Privacy Statement
Copyright 2010, SecurityFocus