Security checklist

[ignopeverell]

Some feedback from the libsecp audit and our use in grin, all simple things we could add for a little more defense in depth:

• Zeroing of sensitive data through Drop (password, mnemonic)
• Check zeroing of private keys in libsecp
• More randomized tests to check invalid range proofs don't validate
• Same for aggsigs

[ghost]

randomness sources if even necessary.
E.g. https://github.com/mimblewimble/rust-secp256k1-zkp/blob/master/src/aggsig.rs#L36
uses thread_rng which, AFAIK, is backed by EntropyRng instead of OsRng

[ignopeverell]

Randomness was already checked, with rand 0.5+ it's fine.

[yeastplume]

Closing, out of date