fix: update nonce generation to use cryptographic RNG (spruceid#20)

* fix: update nonce generation to use cryptographic RNG * feat: add support in core SIWE lib to generate nonces * add new line character for consistency Co-authored-by: Gregório Granado Magalhães <[email protected]> Co-authored-by: Gregório Granado Magalhães <[email protected]>
ROWZZY · Nov 29, 2021 · 00a0f07 · 00a0f07
1 parent 482aa32
commit 00a0f07
Show file tree

Hide file tree

Showing 6 changed files with 81 additions and 5 deletions.
diff --git a/examples/notepad/package-lock.json b/examples/notepad/package-lock.json
diff --git a/examples/notepad/package.json b/examples/notepad/package.json
@@ -59,4 +59,4 @@
         "webpack": "^5.64.0",
         "webpack-cli": "^4.9.1"
     }
-}
+}
diff --git a/examples/notepad/src/index.ts b/examples/notepad/src/index.ts
@@ -12,7 +12,7 @@ import Helmet from 'helmet';
 import Morgan from 'morgan';
 import Path from 'path';
 import FileStore from 'session-file-store';
-import { ErrorTypes, SiweMessage } from 'siwe';
+import { ErrorTypes, SiweMessage, generateNonce } from 'siwe';
 const FileStoreStore = FileStore(Session);
 
 config();
@@ -70,7 +70,7 @@ app.use(
 app.use(Express.static(Path.resolve(__dirname, '../public')));
 
 app.get('/api/nonce', async (req, res) => {
-    req.session.nonce = (Math.random() + 1).toString(36).substring(4);
+    req.session.nonce = generateNonce();
     req.session.save(() => res.status(200).send(req.session.nonce).end());
 });
 

diff --git a/lib/client.ts b/lib/client.ts
@@ -1,3 +1,5 @@
+
+import { randomStringForEntropy } from '@stablelib/random';
 // TODO: Figure out how to get types from this lib:
 import { Contract, ethers, utils } from 'ethers';
 import { ParsedMessage as ABNFParsedMessage } from './abnf';
@@ -114,7 +116,7 @@ export class SiweMessage {
 		const versionField = `Version: ${this.version}`;
 
 		if (!this.nonce) {
-			this.nonce = (Math.random() + 1).toString(36).substring(4);
+			this.nonce = generateNonce();
 		}
 
 		const chainField = `Chain ID: ` + this.chainId || "1";
@@ -281,3 +283,18 @@ export const checkContractWalletSignature = async (
 		throw e;
 	}
 };
+
+/**
+ * This method leverages a native CSPRNG with support for both browser and Node.js
+ * environments in order generate a cryptographically secure nonce for use in the
+ * SiweMessage in order to prevent replay attacks.
+ * 
+ * 96 bits has been chosen as a number to sufficiently balance size and security considerations
+ * relative to the lifespan of it's usage.
+ * 
+ * @returns cryptographically generated random nonce with 96 bits of entropy encoded with
+ * an alphanumeric character set.
+ */
+export const generateNonce = (): string => {
+	return randomStringForEntropy(96);
+}
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -23,6 +23,7 @@
     "typescript": "^4.4.4"
   },
   "dependencies": {
+    "@stablelib/random": "^1.0.1",
     "apg-js": "^4.1.1",
     "ethers": "^5.5.1"
   }
-Original file line number
+Diff line change
@@ Expand Up / @@ -59,4 +59,4 @@ @@
             "webpack": "^5.64.0",
             "webpack-cli": "^4.9.1"
         }
-    }
+    }