News for hackers. Stuff that matters.
Re:OnlyKey: Open-Source Alternative to YubiKey by g_p on Thursday December 26, 2019 @11:58AM (#21885078)
Doing a quick look through the library repository, I spotted another more scary function. It doesn't appear (at a quick glance) to be used anywhere, but still...

https://github.com/trustcrypto/libraries/blob/master/randomb...

For anyone wanting to try this out (it will compile with plain GCC if you add):

    #include <stdlib.h>
    #include <stdio.h>
to the start of the file, and declare a main function:

    void main() {
      unsigned char* buffer;
      buffer = malloc(32 * sizeof(char));
      randombytes(buffer, 32);
      for (int i=0; i < 32; i++) {
        printf("%02x", buffer[i]);
      }
      printf("\n");
      free(buffer);
    }
And you'll (of course) get some rather deterministic output. As I say though, doesn't look to be used (that I could see), but strange to have something like this there.

RE the RNG implementation, looks to be at https://github.com/trustcrypto/libraries/blob/master/Crypto/..., and looks to have some support for hardware RNGs on certain boards, but not others. Does sound like there's no hardware protection involved.

Re:OnlyKey: Open-Source Alternative to YubiKey by cr7pt0 on Thursday December 26, 2019 @12:13PM (#21885171)
If you search the repo you can see the randombytes library is just there for reference and isn't used, that library was created by the same guy who made NaCl https://en.wikipedia.org/wiki/NaCl_(software)