Random number generator used by default is Not Secure
sirk390 opened this issue · 3 comments
sirk390 commented
It seems the random number generator used by default when generating a private key is not secure:
When you call:
>privateKey = PrivateKey()
It does
randint(1, curve.N - 1)
While "randint" is imported from "random" module.
Instead random should use " random.SystemRandom"
rcmstark commented
What you think now:
sirk390 commented
Yes, this is good, but you have also the same issue for signature (ecdsa.py line 14).
rcmstark commented
True. I updated the PR, I will close this issue now.