MetaMask / MetaMask/metamask-extension
Ask for user input to harden random number generation
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
When we generate a mnemonic, we should generate random data in the most secure way possible.
Currently [eth-hd-keyring](https://github.com/MetaMask/eth-hd-keyring/blob/master/index.js#L49) uses the `bip39` module's built-in rng, which defaults to browserify's `crypto/getRandomBytes` method, which is the `crypto.getRandomValues` method:
https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
This seems like one of the best random sources the browser has available, but we should research and verify.
Contributor guide
Research direction
Start by reviewing eth-hd-keyring/index.js around line 49 and the bip39 RNG path, then verify the browser crypto/getRandomValues behavior using the linked MDN documentation. The issue is complete when the security research is documented and a concrete decision is reached about whether and how user input should affect mnemonic randomness.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 22/100