Insecure random bytes generation

[petuhovskiy]

Several places are using dry.RandomBytes:

https://github.com/xelaj/mtproto/blob/8c4c69fd45ad5496bb0f291f6c4eb1750b2b9759/aes_ige/aes.go#L102-L104

https://github.com/xelaj/mtproto/blob/84baaf9e22783ea7d3abc83c805085441a1bda11/serialize/serialize.go#L59

And dry.RandomBytes is using math/rand to generate random bytes array.

Maybe dry.RandomBytes should be using crypto/rand, or this package should implement its own method to generate secure random bytes.

[quenbyako]

Hey @petuhovskiy, thanks for asking!

Well, i think that we need add to go-dry package something like RandomSecureBytes or something like this.

Also, honestly, it's not so neccessary to add crypto random (as i think, but we can discuss about it) for two main reasons:

• math.Rand is way more faster than crypt.Rand
• any random value is hashed, shaked, randomized mutiple times, so you can't do anything even with bad generated random value.

[quenbyako]

I'll leave open this issue, cause math.Rand and crypt.Rand bot has pros and cons