random generator, using arc4 api on Mac rather than "wasting"

[devnexen]

file descriptors.

[nikic]

cc @paragonie-scott (or is it @paragonie-security?)

I believe we allow arc4random_buf only on platforms where it uses a kernel generator. Is that the case on macos?

[devnexen]

It is reseeded by kernel generator in regular basis.

[paragonie-security]

From our understanding, arc4random_buf on OS X should be fine.

[nikic]

@paragonie-security Thanks for checking!

Now I remember that the original issue here were arc4random implementations based on RC4. According to https://security.stackexchange.com/questions/85601/is-arc4random-secure-enough/172905#172905 macos has an AES-based arc4random since macOS 10.2. Guess that's old enough to just allow it.

[paragonie-security]

For flavor: arc4random originally used RC4, but it retconned as "A Reasonable Call 4 Randomness" and used AES or ChaCha-based CSPRNGs. (IIRC OpenBSD uses ChaCha.)