search

dart-bitcoin / bip39

BSD 3-Clause "New" or "Revised" License
44 stars 72 forks source link

`_randomBytes` generates non-uniform random values #23

Open fegge opened 3 years ago

fegge commented 3 years ago

bip39.generateMnemonic uses the Random.secure() CSPRNG from the dart:math library to generate entropy for the mnemonic in _randomBytes.

https://github.com/dart-bitcoin/bip39/blob/3633daa2026b98c523ae9a091322be2903f7a8ab/lib/src/bip39_base.dart#L40-L47

Here _SIZE_BYTE is defined as 255 (on line 10). Since the nextInt method generates integers in the half-open interval [0, max) for a given upper bound max, the value 255 will never be generated. This means that the generated entropy will not be uniformly random. This is an issue if the library is used to generate private keys (e.g. using BIP32).

cylon56 commented 1 year ago

It's concerning that there's no follow-up to this as secure random generation of keys is crucial for anyone using this library.