How secure are passwords and keys generated by RDM?

How secure are passwords and keys generated by RDM?

avatar

I wanted to ask this question a few times already. What finally prompted me to do so is the recent development of reverse engineering AI-powered tools, and especially this fresh research: https://www.anthropic.com/research/ecdsa-curve-origins

In short: In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384, and P-521 elliptic curve seeds. It didn't break EC cryptography (they say it actually increases confidence in the curves), but it shows how easily these days the output of a weak, time-seeded PRNG can be recognized and its internal state recovered.

That is exactly what happened in the past, behind several real incidents, like the Debian OpenSSL bug that produced predictable SSH keys (CVE-2008-0166, https://github.com/g0tmi1k/debian-ssh), the "Milk Sad" wallet thefts (CVE-2023-39910) - Libbitcoin Explorer seeded a Mersenne Twister with 32-bit system time, and countless other cases of using insecure PRNG and/or srand(time(NULL)).

Therefore my questions are:

  • Does RDM use cryptographically secure random number generator for password/keys generation?

  • Does the generator have sufficient amount of entropy?

  • Is the generation secure on every platform RDM is available (Windows, macOS, Linux)?

I'm not suggesting it's insecure, just being a bit paranoid, and I'd simply like to be confident that RDM takes every necessary precaution to make generated data as random as possible, and secure.

Thank you.

All Comments (2)

avatar

Hello,

Thank you for the questions.

Does RDM use cryptographically secure random number generator for password/keys generation?

The password generator gets its randomness from .NET System.Security.Cryptography.RandomNumberGenerator.

We don’t use System.Random or any time-seeded generator. SSH key generation uses BouncyCastle’s SecureRandom.

Does the generator have sufficient amount of entropy?

Since both draw from the operating system’s CSPRNG, RDM doesn’t seed or manage entropy itself, the OS handles it.

Is the generation secure on every platform RDM is available (Windows, macOS, Linux)?

The generator code is shared across platforms.

Beyond this, RDM’s code goes through security reviews as features are developed, regular third-party penetration tests, and our private bug bounty program.

We use OWASP recommendations as a reference for these reviews, including for cryptography and secure random number generation.

Regards,

Mathieu

Mathieu Morrissette

avatar

Thank you for a solid material response!