René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Cryptographic API Misuse Vulnerability: Do not use insecure pseudo random number generator(PRNG) in a security context","articleBody":"Hello!\r\nFirst and foremost, I would like to express my sincere gratitude for your contributions to this project.\r\n\r\n\r\n## Description:\r\nI have identified a security vulnerability in [solcrypto](https://github.com/HarryR/solcrypto) project's about insecure PNRG.\r\n\r\nPRNGs are used to generate random numbers that are unpredictable and uniformly distributed. However, some PRNGs are not truly random and can be predicted or reproduced, which can compromise the security of cryptographic applications that rely on them, such as key derivation, encryption, or digital signatures. Examples of insecure PRNGs are `random.randbytes`, or `random.randint`. These PRNGs should not be used in a security context and replaced by more secure ones, such as `secrets.token_bytes`, or `os.urandom`. It corresponds to CWE-338: Use of Cryptographically Weak PRNG.\r\n\r\n## Locations:\r\nhttps://github.com/HarryR/solcrypto/blob/3c59250005e76bae7de73b753d7406eee15b8e6e/pysolcrypto/polyhash.py#L56\r\nhttps://github.com/HarryR/solcrypto/blob/3c59250005e76bae7de73b753d7406eee15b8e6e/pysolcrypto/polyhash.py#L57\r\n\r\n## References:\r\n[CWE-338: Use of Cryptographically Weak PRNG.](https://cwe.mitre.org/data/definitions/338.html)\r\n\r\n## Recommendations:\r\nRandom IV Generation: Implement a secure random salt generator , such as `secrets` library.\r\n\r\nImmediate attention to this issue is recommended to maintain the privacy and security of solcrypto users.\r\n\r\n","author":{"url":"https://github.com/gxx777","@type":"Person","name":"gxx777"},"datePublished":"2024-01-04T08:50:07.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/20/solcrypto/issues/20"}