search

dchest / tweetnacl-js

Port of TweetNaCl cryptographic library to JavaScript
https://tweetnacl.js.org
The Unlicense
1.78k stars 294 forks source link

setPRNG #224

Closed samaneh-kamalian closed 2 years ago

samaneh-kamalian commented 3 years ago

About one year ago, I used nacl.sign.keyPair in react-native framework, but it returned exception. So as it is mentioned in document I used this codes to resolve the issue:

nacl.setPRNG(function(x, n) {
  // ... copy n random bytes into x ...
});

But now, after about one year, I test to removing this lines of code (setPRNG) and test my application. it works without any exception. Now my question is, In which platforms we need to redefine PRNG? and did you update anything that now it does not need to redefine PRNG in android platform? Thanks in advance.

CMEONE commented 3 years ago

As far as I'm aware, the automatic PRNG detection still uses the same code (or very similar code) without any noticeable changes for React Native support recently. However, I think that the React Native PRNG issue only applies to iOS and not to Android. From my understanding, in iOS, there is no available crypto module or global in Safari webviews within applications, and device-level CSPRNG can only be accessed asynchronously, so it is common to use this asynchronous CSPRNG to instantiate a synchronous PRNG using an initial random seed. I don't believe that this issue applies to Android, but you can test it out to make sure. Also, I'm not sure if iOS applications with Safari webviews have caught up to web standards for Web Cryptography API yet.

samaneh-kamalian commented 3 years ago

I'm sure that about a year ago, when I called nacl.sign.keyPair (), I got a PRNG error and I had to use setPRNG. This issue is also mentioned: https://github.com/dchest/tweetnacl-js/pull/197 Is it clear on which platforms this problem exists?

dchest commented 3 years ago

Just wanted to confirm that nothing has changed with regards to setPRNG in tweetnacl-js.

CMEONE commented 3 years ago

As I suspected, so the change must be either in Android's webview or React Native.