On Mon, Jun 27, 2022 at 06:31:41PM -0700, Vagrant Cascadian wrote:
https://github.com/samboy/MaraDNS/discussions/101#discussioncomment-3006487
Upstream appears to think it is mostly ok to actually embed a specific
random prime... and not have it be different across all the builds, as
the number is mixed with other randomness from /dev/urandom.
It is expensive to generate the random prime on some hardware, so doing
so at runtime might not be feasible in some cases...
So, where do we go from here, knowing what we now know? :)
live well,
vagrant
I looked back at the original email. I think we should not embed a
static random prime and mark it as non-substitutable. Then with that
flag add a note that it generates a prime during building and everyone
having a unique prime is more important to us than everyone having the
same reproducible prime.