search

andelf / tronpy

TRON Python Client Library.
MIT License
212 stars 96 forks source link

Use cryptographically secure generador for private keys #118

Closed MaG21 closed 8 months ago

MaG21 commented 12 months ago

The random module should not be used for security purposes, therefore the use of this module to generate private keys is a security flaw. https://docs.python.org/3/library/random.html

Since this project is not targeting an specific python version, I'm not sure if it's wise to use the secrets module, because this module first appeared on in python 3.6. Instead I'm using _get_random_bytes() (which is os.urandom under the hood) to generate cryptographically secure numbers.

On the other hand and I'm not sure if this logic of generating random private keys is entirely secure. In my opinion, the right way of doing this is using ECDSA or using the library we already have in this project:

from Crypto.PublicKey import RSA
key = RSA.generate(2048)

private_key = key.export_key()
public_key = key.publickey().export_key()
MrNaif2018 commented 8 months ago

Thanks for your PR! Actually, this cryptography lib just uses os.urandom (:

MrNaif2018 commented 8 months ago

https://github.com/Legrandin/pycryptodome/blob/2c40af5eec9b5f3163a00e1c121b3b4081bf8d2c/lib/Crypto/Random/__init__.py#L56C20-L56C27

Changed it and merging, thanks again!