{"action":"created","issue":{"url":"https://api.github.com/repos/eris-ltd/eris-keys/issues/23","labels_url":"https://api.github.com/repos/eris-ltd/eris-keys/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/eris-ltd/eris-keys/issues/23/comments","events_url":"https://api.github.com/repos/eris-ltd/eris-keys/issues/23/events","html_url":"https://github.com/eris-ltd/eris-keys/issues/23","id":105564539,"number":23,"title":"use of experimental, deprecated go-ethereum entropy function","user":{"login":"Gustav-Simonsson","id":293096,"avatar_url":"https://avatars.githubusercontent.com/u/293096?v=3","gravatar_id":"","url":"https://api.github.com/users/Gustav-Simonsson","html_url":"https://github.com/Gustav-Simonsson","followers_url":"https://api.github.com/users/Gustav-Simonsson/followers","following_url":"https://api.github.com/users/Gustav-Simonsson/following{/other_user}","gists_url":"https://api.github.com/users/Gustav-Simonsson/gists{/gist_id}","starred_url":"https://api.github.com/users/Gustav-Simonsson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gustav-Simonsson/subscriptions","organizations_url":"https://api.github.com/users/Gustav-Simonsson/orgs","repos_url":"https://api.github.com/users/Gustav-Simonsson/repos","events_url":"https://api.github.com/users/Gustav-Simonsson/events{/privacy}","received_events_url":"https://api.github.com/users/Gustav-Simonsson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-09T10:00:57Z","updated_at":"2015-09-09T13:42:51Z","closed_at":null,"body":"Looks like this function was picked up when forking old go-ethereum code: https://github.com/eris-ltd/eris-keys/blob/master/crypto/randentropy/rand_entropy.go#L32\r\n\r\nThis function was merely intended as an experiment and to discuss merits of XORing in additional sources onto the OS CSPRNG. It was not intended for production use and has since been removed from the code base since we decided the extra complexity and risks that come with it was not worth potential benefits of additional sources in case the OS source through ```crypto/rand``` is weak.\r\n\r\nWould recommend switching to using plain ```crypto/rand``` helpers currently used in go-ethereum (these where covered by Ethereum's security audits) : https://github.com/ethereum/go-ethereum/blob/master/crypto/randentropy/rand_entropy.go"},"comment":{"url":"https://api.github.com/repos/eris-ltd/eris-keys/issues/comments/138912523","html_url":"https://github.com/eris-ltd/eris-keys/issues/23#issuecomment-138912523","issue_url":"https://api.github.com/repos/eris-ltd/eris-keys/issues/23","id":138912523,"user":{"login":"ebuchman","id":2300911,"avatar_url":"https://avatars.githubusercontent.com/u/2300911?v=3","gravatar_id":"","url":"https://api.github.com/users/ebuchman","html_url":"https://github.com/ebuchman","followers_url":"https://api.github.com/users/ebuchman/followers","following_url":"https://api.github.com/users/ebuchman/following{/other_user}","gists_url":"https://api.github.com/users/ebuchman/gists{/gist_id}","starred_url":"https://api.github.com/users/ebuchman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ebuchman/subscriptions","organizations_url":"https://api.github.com/users/ebuchman/orgs","repos_url":"https://api.github.com/users/ebuchman/repos","events_url":"https://api.github.com/users/ebuchman/events{/privacy}","received_events_url":"https://api.github.com/users/ebuchman/received_events","type":"User","site_admin":false},"created_at":"2015-09-09T13:42:51Z","updated_at":"2015-09-09T13:42:51Z","body":"yup I was following this discussion in go-ethereum. is XORing in this kind of information not a standard practice? were actual risks identified? or was it just \"better not add more complexity\"? I figured I'd keep it at least as a talking point until I had a better idea why it was removed. Seems like if the host OS generator is compromised (as we've seen it has been a few times), this could be a life saviour."}}