Key material from kotlin.random.Random: 4S master key and default pickle key need a CSPRNG (§9)

thecrealm commented

2026-08-25 16:07:21 +02:00

Owner

SessionCrypto.setupSecretStorage() creates the 4S master key with kotlin.random.Random.nextBytes(32) — a non-cryptographic PRNG on every platform — and KatrixSession uses the same for the ephemeral default pickle key (D14). The recovery key sealing cross-signing seeds + backup key must be unpredictable (§9). Fix: a SecureRandom expect/actual seam in katrix-crypto (mirroring transport's OidcCrypto actuals: JVM/Android SecureRandom, Apple arc4random_buf, js/wasm crypto.getRandomValues, linux getrandom), used by 4S setup, the pickle-key default, and the #106 QR shared secret (which is why this lands now, discovered scoping #106).

thecrealm referenced this issue from a commit

2026-08-25 16:10:29 +02:00

Key material comes from the platform CSPRNG, never kotlin.random (§9, D71)

thecrealm closed this issue

2026-08-25 16:10:29 +02:00

Rows
Columns

Key material from kotlin.random.Random: 4S master key and default pickle key need a CSPRNG (§9) #121