MetaMask / MetaMask/metamask-extension

Ask for user input to harden random number generation

Open
#4,210 1 comment 0 reactions 0 assignees View on GitHub
needs-design type-enhancement type-security
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

When we generate a mnemonic, we should generate random data in the most secure way possible.

Currently [eth-hd-keyring](https://github.com/MetaMask/eth-hd-keyring/blob/master/index.js#L49) uses the `bip39` module's built-in rng, which defaults to browserify's `crypto/getRandomBytes` method, which is the `crypto.getRandomValues` method:
https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues

This seems like one of the best random sources the browser has available, but we should research and verify.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing eth-hd-keyring/index.js around line 49 and the bip39 RNG path, then verify the browser crypto/getRandomValues behavior using the linked MDN documentation. The issue is complete when the security research is documented and a concrete decision is reached about whether and how user input should affect mnemonic randomness.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
22/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.