Skip to content

Behaviour of sqleet library if call to entropy function fails #24

Open
@utelle

Description

@utelle

In the implementation of the functions entropy and read_urandom you chose to call system function abort in case of failure to provide random data.

I don't know under which exact conditions a failure might happen. However, for a library I find it inappropriate to abort the process/application. The application should at least get a chance to handle this situation and to gracefully shut down the application. Yes, it is possible to implement a signal handler, but the library behaviour should be at least documented, so that a developer is aware of this.

Personally, I would prefer a solution where some sort of fallback function would be called in case the system function fails. For example, one could provide an own PRNG - yes, maybe slightly less secure, but certainly better than aborting the process. In addition, a warning message could be written to the log.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions