{"type":"rich","version":"1.0","author_name":"npub18mgq58d974fufzhmctax4fllw94p0ym036ct3a27z3ltewz30xqqx763g5","author_url":"https://nostr.ae/npub18mgq58d974fufzhmctax4fllw94p0ym036ct3a27z3ltewz30xqqx763g5","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2018-04-06\n📝 Original message:A significant number of past and current cryptocurrency products\ncontain a JavaScript class named SecureRandom(), containing both\nentropy collection and a PRNG. The entropy collection and the RNG\nitself are both deficient to the degree that key material can be\nrecovered by a third party with medium complexity. There are a\nsubstantial number of variations of this SecureRandom() class in\nvarious pieces of software, some with bugs fixed, some with additional\nbugs added. Products that aren't today vulnerable due to moving to\nother libraries may be using old keys that have been previously\ncompromised by usage of SecureRandom().\n\n\nThe most common variations of the library attempts to collect entropy\nfrom window.crypto's CSPRNG, but due to a type error in a comparison\nthis function is silently stepped over without failing. Entropy is\nsubsequently gathered from math.Random (a 48bit linear congruential\ngenerator, seeded by the time in some browsers), and a single\nexecution of a medium resolution timer. In some known configurations\nthis system has substantially less than 48 bits of entropy.\n\nThe core of the RNG is an implementation of RC4 (\"arcfour random\"),\nand the output is often directly used for the creation of private key\nmaterial as well as cryptographic nonces for ECDSA signatures. RC4 is\npublicly known to have biases of several bits, which are likely\nsufficient for a lattice solver to recover a ECDSA private key given a\nnumber of signatures. One popular Bitcoin web wallet re-initialized\nthe RC4 state for every signature which makes the biases bit-aligned,\nbut in other cases the Special K would be manifest itself over\nmultiple transactions.\n\n\nNecessary action:\n\n   * identify and move all funds stored using SecureRandom()\n\n   * rotate all key material generated by, or has come into contact\n     with any piece of software using SecureRandom()\n\n   * do not write cryptographic tools in non-type safe languages\n\n   * don't take the output of a CSPRNG and pass it through RC4\n\n-\n3CJ99vSipFi9z11UdbdZWfNKjywJnY8sT8"}