Chris: your paper looks great, but what I still don't understand is the exact relationship between openssh, openssl, and the entropy source.
Your paper says: "For HP-SSH to utilize the new RNG no configuration changes need to be made to SSH." That doesn't sound right to me. Openssh's configure script attempts to find your entropy sources, and if it cannot find one, it uses its own fallback internal source. Getting openssh to recognize a new source of entropy, like a newly created /dev/urandom, will require a rebuild, unless I'm missing something.
[...tim spends hour playing with this stuff...]
OK, here's what I think happens. Openssl will detect and use a newly created /dev/[u]random at run time, even if that entropy source didn't exist at build time. But Openssh decides whether or not to use its internal entropy source at build time.
So for example, I had PRNGD running when I built openssl (0.9.6g), and then openssh (3.5p1). Now I stop prngd, and remove its socket. Openssh now stops functioning (i.e., the client dies with "Entropy collection failed" message). I then create HP's new /dev/[u]random devices, and -- whamo! -- openssh starts working again.
I suspect this is because openssh was built to use openssl's entropy, and openssl is smart enough to find the new device at run time. But if openssh was built to use its own entropy source, it will never find /dev/[u]random without a rebuild.
So the question for HP is, what entropy source does HP's SSH product use? My guess is that they'll have to ship a new product to make use of the new /dev/[u]random devices.
-Tim
