Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Keys are generated with with insufficient entropy #1

Closed
r00tkillah opened this issue May 28, 2020 · 1 comment
Closed

Keys are generated with with insufficient entropy #1

r00tkillah opened this issue May 28, 2020 · 1 comment

Comments

@r00tkillah
Copy link

RandomInt seeds prng with insufficient entropy at each invocation

func RandomInt(min, max int) int {
	rand.Seed(time.Now().UnixNano())
	return min + rand.Intn(max-min)
}

RandomAESKey uses the non-cryptoprahically random prng to generate keys:

func RandomAESKey() {
        config.GlobalKey = make([]byte,16)
        _, err := rand.Read(config.GlobalKey[:])
        if err != nil {
                panic(err)
        }
}

If RandomInt has been called prior to RandomAESKey, the prng will be seeded with the unix time of that invocation. However, if it has not been called prior, it will generate the same bytes every time:

Package rand implements pseudo-random number generators.

Random numbers are generated by a Source. Top-level functions, such as Float64 and Int, use a default shared Source that produces a deterministic sequence of values each time a program is run. Use the Seed function to initialize the default Source if different behavior is required for each run. The default Source is safe for concurrent use by multiple goroutines, but Sources created by NewSource are not.

Mathematical interval notation such as [0, n) is used throughout the documentation for this package.

For random numbers suitable for security-sensitive work, see the crypto/rand package.

@darkr4y
Copy link
Owner

darkr4y commented Aug 10, 2020

Thanks for pointing out the deficiencies in the code.
I don’t have much time to review the code and fix it, please submit a PR :)

@darkr4y darkr4y closed this as completed Jul 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants