2
$\begingroup$

Since there is not much info anywhere on the Internet related to this:

  1. Does anyone know if OpenSSL's default CSPRNG is Dual_EC_DRBG or not?
    Their wiki is not very clear…
  2. Related to the first question, does anyone have any experience with OpenSSL on Mac changing the default CSPRNG?
$\endgroup$
2
$\begingroup$

Well, I think OpenSSL has documented this pretty well:

If an alternative RAND_METHOD implementation is being used (either set directly or as provided by an ENGINE module), then it is entirely responsible for the generation and management of a cryptographically secure PRNG stream. The mechanisms described below relate solely to the software PRNG implementation built in to OpenSSL and used by default.

These functions implement a cryptographically secure pseudo-random number generator (PRNG). It is used by other library functions for example to generate random keys, and applications can use it when they need randomness.

...

The RAND_SSLeay() method implements a PRNG based on a cryptographic hash function.

...

hash function; currently SHA-1

So that is certainly not Dual_EC_DRBG. You can switch RNG method by using RAND_set_rand_method but setting a different ENGINE should be preferred for newer applications.

Note that it would not hurt to check this in the source of the openssl implementation you are using. I don't believe it has changed yet, but openssl documentation is not known for its, eh, "up to dateness".

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.