You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Reindl Harald <h....@thelounge.net> on 2013/10/27 05:04:49 UTC

SSLCryptoDevice rdrand

Hi

in case of "SSLCryptoDevice rdrand" is Apache using it exclusive
or as an additional entrophy source? exclusive most likely would
be bad, additional fine, but i do not find any information

http://www.theregister.co.uk/2013/09/10/torvalds_on_rrrand_nsa_gchq/
___________________________

also not clear from the documentation is "SSLCryptoDevice dynamic"
does it use hardware sources like Intel rdrand automatically if
available?

Re: SSLCryptoDevice rdrand

Posted by Reindl Harald <h....@thelounge.net>.
Am 27.10.2013 12:59, schrieb Eric Covener:
> On Sun, Oct 27, 2013 at 12:04 AM, Reindl Harald <h....@thelounge.net> wrote:
>> in case of "SSLCryptoDevice rdrand" is Apache using it exclusive
>> or as an additional entrophy source? exclusive most likely would
>> be bad, additional fine, but i do not find any information
>>
>> http://www.theregister.co.uk/2013/09/10/torvalds_on_rrrand_nsa_gchq/
>> ___________________________
>>
>> also not clear from the documentation is "SSLCryptoDevice dynamic"
>> does it use hardware sources like Intel rdrand automatically if
>> available?
>>
> 
> Both of these are purely openssl questions.  All httpd does is take
> the argument and enable that engine for all uses, by name

thank you for that clear information
so i seek for details on the openssl side

Re: SSLCryptoDevice rdrand

Posted by Eric Covener <co...@gmail.com>.
On Sun, Oct 27, 2013 at 12:04 AM, Reindl Harald <h....@thelounge.net> wrote:
> Hi
>
> in case of "SSLCryptoDevice rdrand" is Apache using it exclusive
> or as an additional entrophy source? exclusive most likely would
> be bad, additional fine, but i do not find any information
>
> http://www.theregister.co.uk/2013/09/10/torvalds_on_rrrand_nsa_gchq/
> ___________________________
>
> also not clear from the documentation is "SSLCryptoDevice dynamic"
> does it use hardware sources like Intel rdrand automatically if
> available?
>

Both of these are purely openssl questions.  All httpd does is take
the argument and enable that engine for all uses, by name.