Make sure that using this number generator is safe (#9)

- Only use random number generators which are recommended by OWASP https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation Signed-off-by: Julian Strobl <[email protected]>
rddl-network · Nov 9, 2023 · 6ae89ce · 6ae89ce
1 parent 36203e3
commit 6ae89ce
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/cid_resolver/app/auth.py b/cid_resolver/app/auth.py
@@ -1,5 +1,5 @@
 import time
-import random
+import secrets
 from cid_resolver.app.verify_signature import validate_signature_data_string
 from cid_resolver.config import (
     AUTH_CHALLENGE_SIZE,
@@ -22,7 +22,7 @@ def does_pub_key_belong_to_valid_actor(pub_key: str) -> bool:
 def create_challenge(pub_key: str) -> int:
     cleanup_pending_challenges()
     challenges[pub_key] = (
-        bytes([random.randint(0, 255) for _ in range(0, AUTH_CHALLENGE_SIZE)]),
+        bytes([secrets.randbelow(256) for _ in range(0, AUTH_CHALLENGE_SIZE)]),
         time.time(),
     )
     return challenges[pub_key][0]