CVE-2023-39910: Milk Sad

[ZioberMichal]

Hey,
is it a chance that Electrum is vulnerable because of the CVE-2023-39910?

See also: milksad.info

Regards
Michał

[SomberNight]

Hi. Nice write-up.

Electrum uses the secrets module from the python standard library as source of entropy. Before that, os.urandom was used directly. Both are considered cryptographically secure.

The interesting code starts here:

electrum/electrum/mnemonic.py

Line 200 in bf86cd6

def make_seed(self, *, seed_type=None, num_bits=None) -> str:

So, no, this issue should not affect Electrum.