3 ms·
Yes: Aside from being a userspace CSPRNG (which is an additional risk of failure over the kernel's CSPRNG and doesn't provide defense-in-depth), it isn't thread
by CiPHPerCoder 10y ago
Yes: Aside from being a userspace CSPRNG (which is an additional risk of failure over the kernel's CSPRNG and doesn't provide defense-in-depth), it isn't thread-safe.
https://github.com/ramsey/uuid/issues/80 https://github.com/ramsey/uuid/issues/80
https://github.com/nodejs/node/issues/5798 https://github.com/nodejs/node/issues/5798
There are also some recent IACR papers (linked in the Node thread), but those are the two biggest concerns.
- kewde 10y agoThank you CiPHPerCoder! That link to NodeJS was a good read, I'm fairly convinced that we should ditch RAND_bytes from OpenSSL for something more secure, we'll look into LibSodium. I've caught rumours of a possible RAND_sys_bytes which operates over the systems CSPRNG? We like to be conservative on the libs. We'd like to tip you for your efforts, do you have a Bitcoin (or ShadowCash) address?
- CiPHPerCoder 10y agoI do, actually, but I haven't accessed it in almost two years. EDIT: And I forgot my password. Here's a new one: 1D6RMsgnTAf2GLWpD91EaQvQ5ppuaZKkGT