Seed weak_rng with the current time if OsRng fails

[cpeterso]

And add a test for weak_rng.

[dhardy]

The main thing I want to say here is that Xorshift is a terrible PRNG to use to seed other PRNGs with. If you want a fallback source of entropy to use when seeding stuff, I'd recommend still using a better PRNG internally (e.g. Isaac: StdRng).

Xorshift is really so bad for seeding stuff that if you seed one XorshiftRng from another, they essentially end up being clones. The refactor in progress will very likely remove this algorithm.

Possibly my recommendation here would be to adapt thread_rng instead, and make weak_rng seed from thread_rng. This does make thread_rng weaker, but it's not supposed to be used for crypto anyway. Not 100% sure if this is agreeable; alternatively you could add a new function.

[dhardy]

Are you sure you don't want this to panic if precise_time_ns is so broken it returns zero? You've got zero entropy in this case... for some uses that doesn't matter but not necessarily all.

[dhardy]

See also dhardy#21 which makes a similar change on my branch of rand

[cpeterso]

Possibly my recommendation here would be to adapt thread_rng instead, and make weak_rng seed from thread_rng. This does make thread_rng weaker, but it's not supposed to be used for crypto anyway. Not 100% sure if this is agreeable; alternatively you could add a new function.

Thanks. I see that fixing thread_rng instead of just weak_rng would avoid these panics for other callers. I will need to check that thread_rng's periodic reseeding also avoids these panics.

[cpeterso]

This PR moves the OsRng fallback into thread_rng and then uses thread_rng to seed weak_rng.

I construct the weak fallback seed from the current system time using std::time, as suggested in dhardy#21 (comment), instead of adding a new crate dependency just for time::precise_time_ns().

[dhardy]

1s = 10^9 ns, not 2^32 ns

It doesn't matter precisely, but if you want a fast approximation use << 30 to avoid leaving 2 empty bits

[cpeterso]

If usize is 32 bits, then shifting secs << 32 (or 30) will lose data. Instead of shifting any bits, I could return them all like [secs, nanos] and let StdRng use the bits as it sees fit. A comment in isaac.rs says reseed() will "make the seed into [seed[0], seed[1], ..., seed[seed.len() - 1], 0, 0, ...], to fill rng.rsl."

[alexcrichton]

Thanks @cpeterso!