Re: Entropy from net devices - keyboard & IDE just as 'bad' [was

[David Wagner]

David Lang  wrote:
>so as I see this discussion it goes something like this.
>
>1. the entropy pool is not large enough on headless machines.
>2. you don't want to use urandom as there are theoretical attacks against
>it

If that's the concern, then I'm glad to say that I have very reassuring
news for you.  No attacks are known on /dev/urandom, not even theoretical
ones.

(And no attack is known on SHA-1, not even a theoretical one.)

(Don't confuse a remote risk that someone might discover a theoretical
attack on SHA-1 with knowledge that we already know of a theoretical
attack on SHA-1.)