Message-Id: <3.0.32.19980604151952.006867c0@kroma.vfi.com>
Date: Thu, 04 Jun 1998 15:19:53 -0700
To: java-security@web2.javasoft.com
From: Deepak Nadig <deepak@vfi.com>
Subject: RandomNumberGenerator Engine Class
Hi,
One of the main uses of Hardware Cryptographic Devices (HCDs) today in
addition to cryptography acceleration and secure key management is the
generation of good hardware based entropy. Every Hardware Cryptographic
Devices we integrate with today are good sources of entropy.
Also, when software libraries are used for Cryptographic operations,
entropy is mined from available hardware sources. One device that is often
used is the sound card. We have spent a lot of time finding and developing
good sources of randomness when our applications use software cryptographic
libraries. When our applications used HCDs, we are able to get entropy from
the HCDs.
I feel that a RandomNumberGenerator Engine class with a getEntropy() method
would be very useful. It would allow different implementations of the
source of randomness, and provide the same benifits available via the
"provider" interfaces in JCA. Akin to the current provider interfaces, an
SPI for the RandomNumberGenerator can be created to allow access to entropy
in HCDs. When HCDs are not being used, an application can provide its own
RandomNumberGenerator that mines good entropy from hardware or software
sources.
I would like to submit this as a proposal and would very much appreciate
your response.
Thanks
Deepak
----------------------------------------------------------------------------
Deepak Nadig email: deepak@vfi.com
Consulting Engineer
Technology Group Phone: 408-919-5618
Internet Commerce Division, VeriFone Fax: 408-919-8807