2

I current use ethers.Wallet.createRandom() to generate private key by extracting .privateKey with ethersjs 5.3.0 in React Native 0.64 app. What is other way to securely generate private key? Somehow ethers.Wallet.createRandom() is extremely slow in my app and I am looking for another way to securely generate private key for eth wallet.

2 Answers 2

2

I've come across many people facing performance issues in RN while generating randomness. If writing a native implementation for PRNGs is the solution, then there should be some experts already working on this. If not, then pls recheck if the RNG process. is really the one that's before attempting to write a PRNG implementation.

Naive random numbers

Since our usual computers are very deterministic, it's difficult to produce unpredictable randomness. A way to generate pseudo-randomness is by utilizing values from the device's env. However, the flaw with this is the fact that some env values are more frequent than others. For e.g. if you are using temperature, then it is likely around 25 deg celsius mostly.

So this creates an opportunity for an attacker (who learned your random number generation algorithm through some reverse engineering on your app binary) to brute force balance check for those keys first which are more probable instead of all of them.

Improved uniformness of random numbers

A Uniform probability for each possible random number means the random number is secure (i.e. attacker can't have some values which are more probable to try first).

You can use Shannon's entropy to analyze the measurements to know how much entropy you get from a single measurement, which can help you know how many measurements are needed for getting the desired entropy. As this is serious stuff, if you're not comfortable with it, I'd suggest consulting an experienced cryptographer to help you with this.

As non-uniform randomness sources, you can use external values like sound, webcam. If you're using CPU and/or RAM data, it's a good idea to ask the user to just start using the system randomly like moving the mouse here and there.

Disclaimer: I'm just an M.Tech Cryptology student and the security of RNGs interests me a lot. But obviously, I'm still a beginner on this topic.

1
  • react-native-random-values claims "cryptographically secure" random value. But not sure how "secure" it is.
    – user938363
    Commented Nov 9, 2021 at 22:31
1

How often you want to generate a private key ?

The best secure way for me is doing it offline with a good source of randomness (card, dice) or in a offline computer with BIP39 from Ian Coleman.

1
  • The key generation need go into an app.
    – user938363
    Commented Jun 10, 2021 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.