diff options
Diffstat (limited to 'changes')
| -rw-r--r-- | changes/bug10402 | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/changes/bug10402 b/changes/bug10402 new file mode 100644 index 000000000..eac00bdc6 --- /dev/null +++ b/changes/bug10402 @@ -0,0 +1,11 @@ + o Major bugfixes: + - Do not allow OpenSSL engines to replace the PRNG, even when + HardwareAccel is set. The only default builtin PRNG engine uses + the Intel RDRAND instruction to replace the entire PRNG, and + ignores all attempts to seed it with more entropy. That's + cryptographically stupid: the right response to a new alleged + entropy source is never to discard all previously used entropy + sources. Fixes bug 10402; works around behavior introduced in + OpenSSL 1.0.0. Diagnosis and investigation thanks to "coderman" + and "rl1987". + |