How secure are passwords and keys generated by RDM?

How secure are passwords and keys generated by RDM?

avatar

I wanted to ask this question a few times already. What finally prompted me to do so is the recent development of reverse engineering AI-powered tools, and especially this fresh research: https://www.anthropic.com/research/ecdsa-curve-origins
In short: In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384, and P-521 elliptic curve seeds. It didn't break EC cryptography (they say it actually increases confidence in the curves), but it shows how easily these days the output of a weak, time-seeded PRNG can be recognized and its internal state recovered.

That is exactly what happened in the past, behind several real incidents, like the Debian OpenSSL bug that produced predictable SSH keys (CVE-2008-0166, https://github.com/g0tmi1k/debian-ssh), the "Milk Sad" wallet thefts (CVE-2023-39910) - Libbitcoin Explorer seeded a Mersenne Twister with 32-bit system time, and countless other cases of using insecure PRNG and/or srand(time(NULL)).

Therefore my questions are:

  • Does RDM use cryptographically secure random number generator for password/keys generation?
  • Does the generator have sufficient amount of entropy?
  • Is the generation secure on every platform RDM is available (Windows, macOS, Linux)?


I'm not suggesting it's insecure, just being a bit paranoid, and I'd simply like to be confident that RDM takes every necessary precaution to make generated data as random as possible, and secure.

Thank you.

All Comments (0)