search

ashtuchkin / u2f

U2F Authentication for Node.js
399 stars 47 forks source link

Use 32 random bytes from crypto library as defined by the spec #2

Closed ziadbz closed 8 years ago

ziadbz commented 8 years ago

The spec specifies 32 bytes for the challenge and you only use 16 bytes. Please see: https://fidoalliance.org/specs/fido-u2f-raw-message-formats-ps-20150514.pdf

zcei commented 8 years ago

+1 from my side, as crypto currently seems to support no more pseudoRandomBytes.

And even if it does: When using u2f the entropy pool of the system is unlikely to be empty. If it is, randomBytes blocks for a few milliseconds until the pool is filled again.

P.S.: I like, that these unnecessary spaces got removed :+1: (probably an editor config, tho)

ashtuchkin commented 8 years ago

Thanks guys!