Consensys / eth-lightwallet

Lightweight JS Wallet for Node and the browser
MIT License
1.47k stars 503 forks source link

Are seeds created with generateRandomSeed insecure? #181

Open claykohut opened 6 years ago

claykohut commented 6 years ago

I was previously generating seeds with generateRandomSeed and then using keyStore.createVault with the generated seed -- is that the wrong way to go about creating an account?

I saw another issue talking about how that was possibly vulnerable to rainbow table lookups -- is that the case or was I misreading?

If this is the wrong way to go about generating seeds, should I first be creating a vault and then getting the seed?

Thanks, Clay

Moejoe90 commented 6 years ago

Can you give a reference to where you might have seen that?

coder5876 commented 6 years ago

@claykohut generateRandomSeed should be secure, this is a good way to create a vault. this is not related to rainbow attacks, the rainbow attacks are mitigated by the salt in the keystore.