https://nostr.ae https://nostr.ae/npub18mgq58d974fufzhmctax4fllw94p0ym036ct3a27z3ltewz30xqqx763g5 https://nostr.ae/nevent1qqspq3mcvwr3dffztt08sjy9ljewwdrwfhdgaxz35uz3g0y703ep4cqzyqldqzsa5h6483y2l0p05648lack59und78tpw84tc28a09c29ucqf0gpls In reply to <a href='/nevent1qqspd6asqaysjvv3rt446y4qpqe5fthzt4w8n2hm9rehpaze4esz3fcafeee5'>nevent1q…eee5</a><br/>_________________________<br/><br/>📅 Original date posted:2018-04-06<br/>📝 Original message:A significant number of past and current cryptocurrency products<br/>contain a JavaScript class named SecureRandom(), containing both<br/>entropy collection and a PRNG. The entropy collection and the RNG<br/>itself are both deficient to the degree that key material can be<br/>recovered by a third party with medium complexity. There are a<br/>substantial number of variations of this SecureRandom() class in<br/>various pieces of software, some with bugs fixed, some with additional<br/>bugs added. Products that aren&#39;t today vulnerable due to moving to<br/>other libraries may be using old keys that have been previously<br/>compromised by usage of SecureRandom().<br/><br/><br/>The most common variations of the library attempts to collect entropy<br/>from window.crypto&#39;s CSPRNG, but due to a type error in a comparison<br/>this function is silently stepped over without failing. Entropy is<br/>subsequently gathered from math.Random (a 48bit linear congruential<br/>generator, seeded by the time in some browsers), and a single<br/>execution of a medium resolution timer. In some known configurations<br/>this system has substantially less than 48 bits of entropy.<br/><br/>The core of the RNG is an implementation of RC4 (&#34;arcfour random&#34;),<br/>and the output is often directly used for the creation of private key<br/>material as well as cryptographic nonces for ECDSA signatures. RC4 is<br/>publicly known to have biases of several bits, which are likely<br/>sufficient for a lattice solver to recover a ECDSA private key given a<br/>number of signatures. One popular Bitcoin web wallet re-initialized<br/>the RC4 state for every signature which makes the biases bit-aligned,<br/>but in other cases the Special K would be manifest itself over<br/>multiple transactions.<br/><br/><br/>Necessary action:<br/><br/> * identify and move all funds stored using SecureRandom()<br/><br/> * rotate all key material generated by, or has come into contact<br/> with any piece of software using SecureRandom()<br/><br/> * do not write cryptographic tools in non-type safe languages<br/><br/> * don&#39;t take the output of a CSPRNG and pass it through RC4<br/><br/>-<br/>3CJ99vSipFi9z11UdbdZWfNKjywJnY8sT8 2023-06-07T20:11:32+02:00