Questions about key generation and RNG

[Simon Nauberg]

Hi list.

I'd have a few questions about key generation and the random number generator and would be happy if you could help me answering them:



a) Is there any easy way to modify gnupg's sourcecode, so that - when creating a key or any signatures - the subpackages get that critical flag set mentioned in the standard for PGP?
As far as I can see it is not directly supported by gnupg for end users but, pointing me to the right place(s) I should be able to patch this in myself.


b) In the German Wikipedia, I've read the following quote:
"Aus Performancegründen wird in der Praxis oft nur der Seed eines Pseudo-Zufallszahlengenerators von /dev/random gelesen (z. B. in OpenSSL, PGP und GnuPG)." (http://de.wikipedia.org/wiki//dev/random)
Which means about, that only the seed of the PRNG from /dev/random would be used by gnupg.
This sounds like a limitation, so what exactly does it mean? Is it that gnupg has it's own PRNG (if so which one? BBS? Yarrow?) and uses /dev/random just to seed that one?


c) When creating keys (especially the asymmetric keys) a good entropy is very critical. Is there kind of a "how to" what one should do or avoid in order to gain "best possible" entropy for that? E.g. things like, not generating a directly after booting, producting a lot of valuable entropy (e.g. via keybord/mouse events) before.


d) Should one use EGD rather than /dev/random (or whatever gnupg uses internally)? If so, why is it better?


e) When creating keys with "highest demands"... it probably makes sense to use TRNGs, right?
If so, does this still help if gnugp comes with its own PRNG and uses /dev/random just for seeding that (see (b) ).

Is it suggested to use several TRNGs at once?

Which TRNGS are suggested?
I know about Simtecs EntropyKey (http://www.entropykey.co.uk/) and turbid (http://www.av8n.com/turbid/). Are there any others which can be bought or so?

Should I use their programs to feed to kernel with entropy, or should I rather create a plain file with their random bits and feed it into /dev/random?


f) Any other hints for key-generation? e.g. obscure tricks like changing the system-time, if that one is taken into account for the RNG. Or stuff like that?


Regards,
Simon.
-- 
GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01