Predictive seed

[magdalenaszumny]

The libcoap library automatically always calls coap_prng_init() during initialization, which has two problematic behaviors:

1. It always uses the coap ticks as the PRNG seed. Coap ticks is uptime, which is on most cases the same value.
2. It calls system-wide PRNG seeding functions (srandom()/srand()), affecting the entire application's random number generation, not just libcoap

Would it be ok to make coap_prng_init() call optional therefore configurable?
What would you think about passing seed as parameter during coap startup?

[mrdeep1]

Are you running on some sort of embedded platform?

Issue 1.

The call to coap_clock_init(), if on a Posix platform, sets coap_clock_offset to be the time in current seconds. Then any call to coap_ticks(&now) updates now to be the effective current time (up to a possible 1 second slow). Then
coap_ticks_to_rt_us(now) returns the current time in microsecs which is used as the PRNG seed.

I have to assume that you are not on a Posix based system and hence coap_ticks(&now) only updates now with the number of ticks since boot.

I dont see why you cannot set up a compile time option for how coap_prng_init_lkd() is built and run (but using HAVE_GETRANDOM may not work for you).

Issue 2

coap_prng_init_lkd() (if HAVE_GETRANDOM is defined) does not invoke srand() / srandom(). So this is where you could use an optional compile time opition.

Otherwise

Would it be ok to make coap_prng_init() call optional therefore configurable?

See suggestions above

What would you think about passing seed as parameter during coap startup?

coap_startup() is a public API and cannot easily be changed.