{"type":"rich","version":"1.0","author_name":"npub1p6uknnmm7wknvg9cq5wqsf7ulpsrdzd6zt6qw707y5t05fuzvfdsx8etde","author_url":"https://nostr.ae/npub1p6uknnmm7wknvg9cq5wqsf7ulpsrdzd6zt6qw707y5t05fuzvfdsx8etde","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2018-04-06\n📝 Original message:Source?\n\nOn Fri, Apr 6, 2018 at 4:53 PM, ketamine--- via bitcoin-dev \u003c\nbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\n\u003e A significant number of past and current cryptocurrency products\n\u003e contain a JavaScript class named SecureRandom(), containing both\n\u003e entropy collection and a PRNG. The entropy collection and the RNG\n\u003e itself are both deficient to the degree that key material can be\n\u003e recovered by a third party with medium complexity. There are a\n\u003e substantial number of variations of this SecureRandom() class in\n\u003e various pieces of software, some with bugs fixed, some with additional\n\u003e bugs added. Products that aren't today vulnerable due to moving to\n\u003e other libraries may be using old keys that have been previously\n\u003e compromised by usage of SecureRandom().\n\u003e\n\u003e\n\u003e The most common variations of the library attempts to collect entropy\n\u003e from window.crypto's CSPRNG, but due to a type error in a comparison\n\u003e this function is silently stepped over without failing. Entropy is\n\u003e subsequently gathered from math.Random (a 48bit linear congruential\n\u003e generator, seeded by the time in some browsers), and a single\n\u003e execution of a medium resolution timer. In some known configurations\n\u003e this system has substantially less than 48 bits of entropy.\n\u003e\n\u003e The core of the RNG is an implementation of RC4 (\"arcfour random\"),\n\u003e and the output is often directly used for the creation of private key\n\u003e material as well as cryptographic nonces for ECDSA signatures. RC4 is\n\u003e publicly known to have biases of several bits, which are likely\n\u003e sufficient for a lattice solver to recover a ECDSA private key given a\n\u003e number of signatures. One popular Bitcoin web wallet re-initialized\n\u003e the RC4 state for every signature which makes the biases bit-aligned,\n\u003e but in other cases the Special K would be manifest itself over\n\u003e multiple transactions.\n\u003e\n\u003e\n\u003e Necessary action:\n\u003e\n\u003e   * identify and move all funds stored using SecureRandom()\n\u003e\n\u003e   * rotate all key material generated by, or has come into contact\n\u003e     with any piece of software using SecureRandom()\n\u003e\n\u003e   * do not write cryptographic tools in non-type safe languages\n\u003e\n\u003e   * don't take the output of a CSPRNG and pass it through RC4\n\u003e\n\u003e -\n\u003e 3CJ99vSipFi9z11UdbdZWfNKjywJnY8sT8\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\n\n\n-- \nMatías Alejo Garcia\n@ematiu\nRoads? Where we're going, we don't need roads!\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180406/7cdc248c/attachment-0001.html\u003e"}