Re: To gnupg or not to gnupg ... (was Re: Assertion while pui-list-packages)
On 04 Dec 1998 05:32:33 PST, you said:
Once I did manage to get it built (and after generating a secure key
on a Linux box with /dev/random and importing it to the BSDI box) it
spits this at me when stuff is signed:
This is, in *general*, not the recommended procedure, for all the
obvious reasons having to do with people seeing the keys as they go by
on the wire or finding the floppy after you sneakernet it. Now, if
you use sufficient care (such as using SSH with good crypto support),
you can close those exposures, but... ;)
Um, what does having a weak RNG have to do with signing with a key
generated with a strong RNG?
Due to the above, the code is making an assumption that the key was
generated on the local machine. It has no way of knowing that you
built it on a machine with a working /dev/random and played crypto
games behind its back...
--
Valdis Kletnieks
Computer Systems Senior Engineer
Virginia Tech
Attachments:
- attachment.sig (application/pgp-signature — 284 bytes)