Patches for gnupg 1.0.7 / cygwin 1.3.10

[Chris Polley]

Hi, Volker:

On Wed, 05 Jun 2002 15:26:37 +0200, you wrote:

>I don't know how good the generated entropy is. This question goes to=20
>the cygwin list. How generated? How good?

/dev/random (and /dev/urandom) is implemented in
/winsup/cygwin/fhandler_random.cc in the source code for the cygwin1
dll. (CVS version 1.18 is the current release, available at
http://sources.redhat.com/cgi-bin/cvsweb.cgi/src/winsup/cygwin/fhandler_r=
andom.cc?cvsroot=3Dsrc
[for the gnupg-devel readers wishing to review the code]

It uses the MS-supplied CryptGenRandom call to generate the random
bytes.  According to MSDN
(http://msdn.microsoft.com/library/en-us/security/security/cryptgenrandom=
.asp),
this function takes a seed value supplied by the program (cygwin1.dll
passes on the contents of the read buffer) and adds it to "both the
stored seed and various system data and user data such as the process
ID and thread ID, the system clock, the system time, the system
counter, memory status, free disk clusters, the hashed user
environment block. This result is SHA-1 hashed, and the output is used
to seed an RC4 stream, which is then used as the random stream and
used to update the stored seed."

CryptGenRandom is available in NT/2k/XP/95(OSR2)/98/ME (in 95,
requires IE 3.02)

If the function isn't available for some reason, reads from
/dev/random fail (although reads from /dev/urandom will fall back to a
prng)

It seems that the windows dll attempts to check its signature before
allowing use, although I didn't see any details of that feature (other
than the error codes for bad sig, unable to verify sig, etc.)

I guess the advantage of rndw32 is that it is completely open source
(I'm assuming that the source to the winseed DLL is available... BTW,
why is the winseed DLL not dist in the gpg tarball?)

Warm Regards,
Chris