#93 Making privilegedScope["entropy"] safer

[Steve Jenson]

We will probably use the suggestion from the second
message quoted below.

From
http://www.eros-os.org/pipermail/e-lang/2004-October/010097.html

privilegedScope["entropy"] does not appear safe to
untrusted code.

The methods that appear dangerous, and why, are:

setSeed/1 (client could supply nonrandom bits)
setSeed/2 ''
getProvider/0 (mutable object)

I propose that:

1. These methods be suppressed, or

2. A safe facet be provided, or

3. The next* methods be provided on a separate object
from the
mutating methods.

Also: Is there a safe (no builtin external entropy
sources) PRNG that
untrusted code could import?

From
http://www.eros-os.org/pipermail/e-lang/2004-October/010103.html

Kevin Reid wrote:
> On Oct 5, 2004, at 14:51, Bill Frantz wrote:
>> Note that a hostile program can attack the estimate
of available
>> entropy by calling setSeed/2 with high estimates of
the available entropy.
>> It might be wise to suppress this method to prevent
this attack.
>
> If this is true, surely it is equally possible to do
so with setSeed/1?
>
> setSeed/1 "assumes 1 bit of entropy for each byte of
the seed",
> according to its documentation.

Right -- although it should be safe to provide a sugar
method

public void setSeed(byte[] seed) {
unsugared.setSeed(seed, 0); }