<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 19-Apr-17 21:43, Mark Andrews wrote:<br>
</div>
<blockquote
cite="mid:%3C20170420014351.B2CDE6C1C65D@rock.dv.isc.org%3E"
type="cite">...<br>
<pre wrap="">DSA requires random values as part of the signing process. Really
all CPU's should have real random number sources built into them
and new genuine random values should only be a instruction code away.
Mark
</pre>
</blockquote>
Most recent ones do. See RDRAND for Intel (and AMD). Even
Raspberry Pi.<br>
<br>
The tinfoil hat brigade in some distributions has resisted using
them, fearing some conspiracy to provide not-so-random numbers.
(Despite the fact that /dev/random hashes/whitens the inputs to the
entropy pool.) You may need to take a positive action to enable use
of the hardware source. Google RDRAND for plenty of entertainment.<br>
<br>
There are also fairly inexpensive (~usd 50) USB devices that provide
reasonable entropy quality at decent speeds. (But much lower than
RDRAND.) They're good for the old hardware that you recycle for
single-purpose servers.<br>
<br>
Systems that have low activity/low entropy can benefit from
entropybroker (<a href="https://www.vanheusden.com/entropybroker/">https://www.vanheusden.com/entropybroker/</a>).
Use it to distribute entropy from those who have to those who
don't. It's really handy for VMs, and for that isolated system that
you use for your root keys.<br>
<br>
For most uses, use /dev/urandom - which doesn't block. /dev/random
will block if the entropy pool is depleted. (However, if you have a
hardware source, very, very rarely.) /dev/random is recommended for
long lived keys - which usually includes KSKs, and may include
ZSKs. I don't believe named makes a distinction...you get to pick
one for everything.<br>
<br>
<pre class="moz-signature" cols="72">Timothe Litt
ACM Distinguished Engineer
--------------------------
This communication may not represent the ACM or my employer's views,
if any, on the matters discussed.
</pre>
<br>
</body>
</html>