close Warning: Can't synchronize with repository "(default)" (/project/cl-openid/svn does not appear to be a Subversion repository.). Look in the Trac log for more information.

Opened 7 years ago

Closed 4 years ago

Last modified 4 years ago

#14 closed defect (fixed)

secure random number generation

Reported by: mpasternacki Owned by:
Priority: major Milestone:
Component: code Version: 1.0 portable
Keywords: Cc:


Currently, random values are generated using CL:RANDOM function. This is far from cryptographically secure. Spec refers to RFC 1750 Randomness Recommendations for Security; these recommendations should be implemented, as a separate library, and this library should be used for generating random numbers.

Change History (2)

comment:1 Changed 4 years ago by avodonosov

  • Resolution set to fixed
  • Status changed from new to closed

The ticket is fixed.

A library for secure random numbers is implemented:

The current implementation is not pure-lisp, it reuses OpenSSL random number generator (via cl+ssl). Pure-lisp library would be better probably, but the OpenSSL way was the simpler. Implementing a pure lisp secure random number generator not only requires the RNG algorithm coding; the most expensive part will be gathering a truly unguessable initial state for the generator. OpenSSL does this from a platform specific service, like /dev/random, Windows Crypto API, Entropy Gathering Daemon, etc. The secure-random interface hides the implementation details, so when (and if) it will be reimplemented in lisp, the cl-openid code will not be affected.

cl-openid already unconditionally depends on cl+ssl via drakma, therefore this solution does not add a redundant dependency.

As of today, secure-random is not on quicklisp. Also it uses the very fresh cl+ssl with is also not in quicklisp.

To trt it just download the secure random snapshot:

Then download the cl+ssl snapshot:

(pushnew "<your cl-openid repository>" asdf:*central-registry* :test #'equal)
(pushnew "<your cl+ssl snapshot dir>" asdf:*central-registry* :test #'equal)
(pushnew "<your secure-random snapshot dir>" asdf:*central-registry* :test #'equal)

(ql:quickload :cl-openid)

comment:2 Changed 4 years ago by avodonosov

  • Version changed from 1.1 extended to 1.0 portable
Note: See TracTickets for help on using tickets.