tinygo-org/tinygo
1
0
Fork 0
mirror of https://github.com/tinygo-org/tinygo.git synced 2026-08-22 21:39:01 +00:00
Code Issues Packages Projects Releases 6 Wiki Activity

rp2040: do not use GetRNG in crypto/rand

Browse Source 
The crypto/rand package is used for sensitive cryptographic operations.
Do not use the rp2040 RNG for this purpose, because it's not strong
enough for cryptography.

I think it is _possible_ to make use of the RP2040 RNG to create
cryptographically secure pseudo-random numbers, but it needs some
entropy calculation and secure hashing (blake2s or so) to make them
truly unpredictable.
This commit is contained in:
Ayke van Laethem
2022-09-15 11:05:56 +02:00
committed by Ron Evans
parent 5551ec7a1e
commit d3863f337d
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/crypto/rand/rand_baremetal.go
+2 -2
View File
@@ -1,5 +1,5 @@
//go:build nrf52840 || stm32 || (sam && atsamd51) || (sam && atsame5x) || rp2040 //go:build nrf52840 || stm32 || (sam && atsamd51) || (sam && atsame5x)
// +build nrf52840 stm32 sam,atsamd51 sam,atsame5x rp2040 // +build nrf52840 stm32 sam,atsamd51 sam,atsame5x
package rand package rand
src/machine/machine_rp2040_rng.go
+4
View File
@@ -13,6 +13,10 @@ import (
const numberOfCycles = 32 const numberOfCycles = 32
// GetRNG returns 32 bits of semi-random data based on ring oscillator. // GetRNG returns 32 bits of semi-random data based on ring oscillator.
//
// Unlike some other implementations of GetRNG, these random numbers are not
// cryptographically secure and must not be used for cryptographic operations
// (nonces, etc).
func GetRNG() (uint32, error) { func GetRNG() (uint32, error) {
var val uint32 var val uint32
for i := 0; i < 4; i++ { for i := 0; i < 4; i++ {