,
10 tweets,
3 min read
Read on Twitter
There is an entire javascript package dedicated to collecting entropy in that codebase.
Hope that was well audited.
Hope that was well audited.
It's like a beautiful red flag fractal where the closer you look at any particular red flag the more you find red flags.
Definitely want to make sure that clients using a browser that has been out of extended support for 5 years are generating secure random numbers too.
Seriously you can look anywhere.
I have so many questions.
Ah....the reason there is so much new crypto code is because they lifted a ton of it from BouncyCastle and then changed things.
Definitely a safe, maintainable approach.
Definitely a safe, maintainable approach.
Actually I take that back, there is some copying from BC, but it is definitely not the main reason for so much new crypto code.
There appears to be some duplication too:
There appears to be some duplication too:
Wow there are a couple of these kinds of comments....reassuring.
When the prover and verifier share the same big warning message, which looks like it came from a review that was never followed up on...that's definitely not a good sign.
I know the full audits were not released, but it is interesting to note that apparently some comments in the code point towards some of the earlier findings (& fixes).
* a "packed" ciphertext can be mixed, and the data can be recovered, but the proofs dont verify."" src="/images/1px.png" data-src="https://pbs.twimg.com/media/DzofYx9UcAAMYGY.png">
