What's wrong with generating private keys in this way?

Question

Mostly out of curiosity, but if you wanted to generate your own ethereum private/public key pair, and NOTE use anyone else's code, is there anything that's wrong with doing it like this:

const validChars = ["a", "b", "c", "d", "e", "f", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9"]
let key = ""

for (var i = 0; i < 64; i++) {
    let rand = validChars[Math.floor(Math.random() * validChars.length)];
    key += rand
}

//key is now a random string of 64 valid ETH characters
console.log(key)

Answer 1

Essentially, yes, a private key is just a random number. That said, I see two things wrong with your code:

1. Be careful to use a random number generator that's meant for cryptographic security. In Node.js, you would want to use crypto (e.g. crypto.randomBytes(32)).
2. Not all 256-bit random numbers are valid private keys. The private key has to be less than 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141, which is the n value for the elliptic curve being used (secp256k1). It also has to be greater than 0. (Thanks @Ismael.)