From: wintermute_77@... Date: 2018-05-18T02:59:57+00:00 Subject: [ruby-core:87153] [Ruby trunk Bug#14773] SecureRandom.alphanumeric Uses Insecure Underlying Implementation Issue #14773 has been reported by wintermute_77@yahoo.com (Steven Hay). ---------------------------------------- Bug #14773: SecureRandom.alphanumeric Uses Insecure Underlying Implementation https://bugs.ruby-lang.org/issues/14773 * Author: wintermute_77@yahoo.com (Steven Hay) * Status: Open * Priority: Normal * Assignee: * Target version: * ruby -v: 2.5.1 * Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN ---------------------------------------- I believe that the implementation of SecureRandom.alphanumeric uses an underlying PRNG that is not the same as the one selected by the SecureRandom module. This is because the alphanumeric method uses the :choose method (line 291 in 2.5.1) which in turn uses the :random_number method (line 254,261). The :random_number method is defined in the Random::Formatter module in random.c (The function is rand_random_number (Line 1369 and associated on line 1647). At any rate, once it is in random.c, it ends up using the insecure PRNG built into random.c. I have a patch, but probably not one that is production quality. It it pretty simple--it overrides the random_number provided in Random::Formatter to use the :bytes method already defined. ~~~ ruby module SecureRandom def self.random_number max_range b = SecureRandom.bytes 1 n = b.ord/256.0*max_range n.to_i end end ~~~ At any rate, it may be a bad idea to extend SecureRandom with Random::Formatter in general, since it allows paths to use of the insecure underlying PRNG in random.c. -- https://bugs.ruby-lang.org/ Unsubscribe: