As is this is just a footgun if you fork, we need *some* solution to that.


On Fri, Dec 20, 2013 at 4:41 PM, Paul Kehrer <notifications@github.com>wrote:

> In cryptography/hazmat/backends/openssl/backend.py:
>
> > @@ -223,6 +223,21 @@ def create_symmetric_encryption_ctx(self, cipher, mode):
> >      def create_symmetric_decryption_ctx(self, cipher, mode):
> >          return _CipherContext(self, cipher, mode, _CipherContext._DECRYPT)
> >
> > +    def generate_rsa_ctx(self, bit_length, public_exponent):
> > +        if public_exponent < 3 or public_exponent % 2 == 0:
> > +            raise ValueError("Public exponent must be odd and 3 or greater "
> > +                             "(65537 recommended)")
> > +        ctx = self.lib.RSA_new()
> > +        ctx = self.ffi.gc(ctx, self.lib.RSA_free)
> > +        bn = self.lib.BN_new()
> > +        bn = self.ffi.gc(bn, backend.lib.BN_free)
> > +        res = self.lib.BN_set_word(bn, public_exponent)
> > +        res = self.lib.RSA_generate_key_ex(
> > +            ctx, bit_length, bn, self.ffi.NULL
> > +        )
>
> @tiran <https://github.com/tiran> might want to weigh on this. My
> understanding is that the pthread_atfork code that was originally landed in
> CPython to reseed the OpenSSL PRNG at fork had to be backed out. The only
> other solution to this issue that I'm aware of is my urandom engine<https://github.com/reaperhulk/openssl-engine-urandom>experiment.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/292/files#r8515297>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084