anytype-heart icon indicating copy to clipboard operation
anytype-heart copied to clipboard

use crypto safe prng for session seed

Open SilverBut opened this issue 1 year ago • 0 comments


  • [x] I understand that contributing to this repository will require me to agree with the CLA

Description

This PR replaces math/rand with crypto/rand when generating seed. The math/rand is using LFG without cryptography guarantee. Seed format is changed by adding 8 more bytes, but should be safe since it's not used yet.

Risk of panic() seems acceptable, because it only happens under these scenarios, and those would almost crash other parts of the application first:

  • *nix: Raise error if open or read /dev/urandom read failed.
  • Windows: Call to RtlGenRandom failed. Discussed in golang/go#33542 and seems only fail if "a size addition overflows", which seems hard in this case.
  • Javascript: Never fail

So I think it won't panic under most cases.

What type of PR is this? (check all applicable)

  • [x] 🍕 Feature
  • [ ] 🐛 Bug Fix
  • [ ] 📝 Documentation Update
  • [ ] 🎨 Style
  • [ ] 🧑‍💻 Code Refactor
  • [ ] 🔥 Performance Improvements
  • [ ] ✅ Test
  • [ ] 🤖 Build
  • [ ] 🔁 CI

Related Tickets & Documents

N/A

Mobile & Desktop Screenshots/Recordings

N/A

Added tests?

  • [ ] 👍 yes
  • [x] 🙅 no, because they aren't needed
  • [ ] 🙋 no, because I need help

Added to documentation?

  • [ ] 📜 README.md
  • [ ] 📓 tech-docs
  • [x] 🙅 no documentation needed

SilverBut avatar Aug 16 '23 18:08 SilverBut